openapi: 3.2.0
info:
title: Conure V2 API
version: conure-218-1-ee422dee
license:
name: All Rights Reserved
url: https://www.cisco.com
contact:
name: Cisco Security Business Group -- Advanced Threat
email: cisco-intel-api-support@cisco.com
description: XDR High Priority Incident and Investigation API
x-provenance:
method: harvested
authored_by: Cisco XDR
harvested_by: API Evangelist
harvested_on: '2026-08-19'
first_party: true
provider_published: true
source_host: visibility.amp.cisco.com
note: Anonymously fetchable Swagger 2.0 for nine IROH services plus the CTIA threat-intelligence API. The host returns real 404s on invented paths, so the 200s are genuine.
x-evidence:
- type: source
url: https://visibility.amp.cisco.com/iroh/iroh-int/swagger.json
- type: source
url: https://private.intel.amp.cisco.com/swagger.json
tags:
- name: v2
paths:
/v2/casebook:
post:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'201':
description: ''
content:
application/json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/transit+msgpack:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/transit+json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/edn:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
tags:
- v2
summary: Adds a new Casebook
security:
- JWT-Bearer: []
- oauth2: []
- JWT-Bearer: []
requestBody:
content:
application/json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
application/transit+msgpack:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
application/transit+json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
application/edn:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
required: true
/v2/casebook/external_id/{external-id}:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
headers:
- map
- - x-sort
- optional: true
- - maybe
- - vector
- any
- - x-next
- optional: true
- string
- - x-total-hits
- optional: true
- - int
- title: PositiveInteger
json-schema/description: A integer greater than 0.
json-schema/example: 2
min: 0
description: ''
content:
application/json:
schema:
type: array
items:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/transit+msgpack:
schema:
type: array
items:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/transit+json:
schema:
type: array
items:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/edn:
schema:
type: array
items:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: external-id
description: ''
required: true
schema:
type: string
- in: query
name: sort_by
description: 'Sort result on fields.
The following fields are supported:
id, language, revision, schema_version, source, source_uri, timestamp, title, tlp
Fields can be combined with '','' and sort order can be
specified by '':asc'' and '':desc''. For example:
- id # sort by id ascending
- id:desc # sort by id descending
- id,language:desc # sort by id ascending, then language descending'
required: false
schema:
type: string
- in: query
name: sort_order
description: ''
required: false
schema:
type: string
enum:
- asc
- desc
- description: A integer greater than 0.
name: offset
title: PositiveInteger
example: 2
required: false
in: query
schema:
type: integer
format: int64
minimum: 0
- description: A integer greater than 0.
name: limit
title: PositiveInteger
example: 2
required: false
in: query
schema:
type: integer
format: int64
minimum: 0
- in: query
name: search_after
description: ''
required: false
x-anyOf:
- type: array
items:
type: string
- type: string
allowEmptyValue: true
schema:
type: array
items:
type: string
- in: query
name: fields
description: ''
required: false
x-anyOf:
- type: array
items:
type: string
enum:
- schema_version
- revision
- source
- title
- source_uri
- language
- id
- tlp
- timestamp
- type: string
allowEmptyValue: true
schema:
type: array
items:
type: string
enum:
- schema_version
- revision
- source
- title
- source_uri
- language
- id
- tlp
- timestamp
tags:
- v2
summary: List Casebook by external id
security:
- JWT-Bearer: []
- oauth2: []
- JWT-Bearer: []
/v2/casebook/search:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
headers:
- map
- - x-sort
- optional: true
- - maybe
- - vector
- any
- - x-next
- optional: true
- string
- - x-total-hits
- optional: true
- - int
- title: PositiveInteger
json-schema/description: A integer greater than 0.
json-schema/example: 2
min: 0
description: ''
content:
application/json:
schema:
type: array
items:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/transit+msgpack:
schema:
type: array
items:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/transit+json:
schema:
type: array
items:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/edn:
schema:
type: array
items:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: query
name: sort_by
description: 'Sort result on fields.
The following fields are supported:
id, language, revision, schema_version, source, source_uri, timestamp, title, tlp
Fields can be combined with '','' and sort order can be
specified by '':asc'' and '':desc''. For example:
- id # sort by id ascending
- id:desc # sort by id descending
- id,language:desc # sort by id ascending, then language descending'
required: false
schema:
type: string
- in: query
name: sort_order
description: ''
required: false
schema:
type: string
enum:
- asc
- desc
- description: A integer greater than 0.
name: offset
title: PositiveInteger
example: 2
required: false
in: query
schema:
type: integer
format: int64
minimum: 0
- description: A integer greater than 0.
name: limit
title: PositiveInteger
example: 2
required: false
in: query
schema:
type: integer
format: int64
minimum: 0
- in: query
name: search_after
description: ''
required: false
x-anyOf:
- type: array
items:
type: string
- type: string
allowEmptyValue: true
schema:
type: array
items:
type: string
- in: query
name: fields
description: ''
required: false
x-anyOf:
- type: array
items:
type: string
enum:
- schema_version
- revision
- source
- title
- source_uri
- language
- id
- tlp
- timestamp
- type: string
allowEmptyValue: true
schema:
type: array
items:
type: string
enum:
- schema_version
- revision
- source
- title
- source_uri
- language
- id
- tlp
- timestamp
- in: query
name: tlp
description: ''
required: false
schema:
type: string
enum:
- amber
- green
- red
- white
- in: query
name: from
description: ''
required: false
schema:
type: string
format: date-time
- in: query
name: to
description: ''
required: false
schema:
type: string
format: date-time
- in: query
name: language
description: ''
required: false
schema:
type: string
- in: query
name: id
description: ''
required: false
schema:
type: string
- in: query
name: search_fields
description: ''
required: false
x-anyOf:
- type: string
enum:
- id
- short_description
- observables.value
- title
- source
- description
- type: string
allowEmptyValue: true
schema:
type: string
enum:
- id
- short_description
- observables.value
- title
- source
- description
- in: query
name: source
description: ''
required: false
schema:
type: string
- in: query
name: query
description: ''
required: false
schema:
type: string
- in: query
name: simple_query
description: Query String with simple query format
required: false
schema:
type: string
- description: A integer greater than 0.
name: revision
title: PositiveInteger
example: 2
required: false
in: query
schema:
type: integer
format: int64
minimum: 0
- in: query
name: texts.text
description: ''
required: false
schema:
type: string
tags:
- v2
summary: Search casebooks
security:
- JWT-Bearer: []
- oauth2: []
- JWT-Bearer: []
/v2/casebook/{casebook-id}:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/transit+msgpack:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/transit+json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/edn:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: casebook-id
description: The casebook in scope
required: true
example: casebook-8d148239-8fda-4fe8-973e-3f181396101f
schema:
type: string
tags:
- v2
summary: Get one casebook by id
security:
- JWT-Bearer: []
- oauth2: []
- JWT-Bearer: []
put:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/transit+msgpack:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/transit+json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/edn:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: casebook-id
description: The casebook in scope
required: true
example: casebook-8d148239-8fda-4fe8-973e-3f181396101f
schema:
type: string
tags:
- v2
summary: Updates a Casebook
security:
- JWT-Bearer: []
- oauth2: []
- JWT-Bearer: []
requestBody:
content:
application/json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
application/transit+msgpack:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
application/transit+json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
application/edn:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
required: true
delete:
responses:
'204':
description: ''
content:
application/json:
schema: {}
application/transit+msgpack:
schema: {}
application/transit+json:
schema: {}
application/edn:
schema: {}
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: casebook-id
description: The casebook in scope
required: true
example: casebook-8d148239-8fda-4fe8-973e-3f181396101f
schema:
type: string
tags:
- v2
summary: Deletes a Casebook
security:
- JWT-Bearer: []
- oauth2: []
- JWT-Bearer: []
patch:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/transit+msgpack:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/transit+json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/edn:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: casebook-id
description: The casebook in scope
required: true
example: casebook-8d148239-8fda-4fe8-973e-3f181396101f
schema:
type: string
tags:
- v2
summary: Partially Update a Casebook
security:
- JWT-Bearer: []
- oauth2: []
- JWT-Bearer: []
requestBody:
content:
application/json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
application/transit+msgpack:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
application/transit+json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
application/edn:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
required: true
/v2/casebook/{casebook-id}/summary:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
incidents:
type: array
items:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
required:
- id
- groups
- schema_version
- type
- incidents
application/transit+msgpack:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
incidents:
type: array
items:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
required:
- id
- groups
- schema_version
- type
- incidents
application/transit+json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
incidents:
type: array
items:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
required:
- id
- groups
- schema_version
- type
- incidents
application/edn:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
incidents:
type: array
items:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
required:
- id
- groups
- schema_version
- type
- incidents
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: casebook-id
description: The casebook in scope
required: true
example: casebook-8d148239-8fda-4fe8-973e-3f181396101f
schema:
type: string
tags:
- v2
summary: Returns a casebook and it's related incidents.
security:
- JWT-Bearer: []
- oauth2: []
- JWT-Bearer: []
/v2/casebook/{casebook-id}/observables:
post:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/transit+msgpack:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/transit+json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/edn:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: casebook-id
description: The casebook in scope
required: true
example: casebook-8d148239-8fda-4fe8-973e-3f181396101f
schema:
type: string
tags:
- v2
summary: Updates a casebook's observables
security:
- JWT-Bearer: []
- oauth2: []
- JWT-Bearer: []
requestBody:
content:
application/json:
schema:
type: object
properties:
operation:
type: string
enum:
- add
- remove
- replace
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
required:
- operation
- observables
application/transit+msgpack:
schema:
type: object
properties:
operation:
type: string
enum:
- add
- remove
- replace
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
required:
- operation
- observables
application/transit+json:
schema:
type: object
properties:
operation:
type: string
enum:
- add
- remove
- replace
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
required:
- operation
- observables
application/edn:
schema:
type: object
properties:
operation:
type: string
enum:
- add
- remove
- replace
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
required:
- operation
- observables
required: true
/v2/casebook/{casebook-id}/bundle:
post:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/transit+msgpack:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/transit+json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/edn:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: casebook-id
description: The casebook in scope
required: true
example: casebook-8d148239-8fda-4fe8-973e-3f181396101f
schema:
type: string
tags:
- v2
summary: Updates a casebook's bundle
security:
- JWT-Bearer: []
- oauth2: []
- JWT-Bearer: []
requestBody:
content:
application/json:
schema:
type: object
properties:
operation:
type: string
enum:
- add
- remove
- replace
bundle: {}
required:
- operation
- bundle
application/transit+msgpack:
schema:
type: object
properties:
operation:
type: string
enum:
- add
- remove
- replace
bundle: {}
required:
- operation
- bundle
application/transit+json:
schema:
type: object
properties:
operation:
type: string
enum:
- add
- remove
- replace
bundle: {}
required:
- operation
- bundle
application/edn:
schema:
type: object
properties:
operation:
type: string
enum:
- add
- remove
- replace
bundle: {}
required:
- operation
- bundle
required: true
/v2/casebook/{casebook-id}/texts:
post:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/transit+msgpack:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/transit+json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/edn:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: casebook-id
description: The casebook in scope
required: true
example: casebook-8d148239-8fda-4fe8-973e-3f181396101f
schema:
type: string
tags:
- v2
summary: Updates a casebook's texts
security:
- JWT-Bearer: []
- oauth2: []
- JWT-Bearer: []
requestBody:
content:
application/json:
schema:
type: object
properties:
operation:
type: string
enum:
- add
- remove
- replace
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
required:
- operation
- texts
application/transit+msgpack:
schema:
type: object
properties:
operation:
type: string
enum:
- add
- remove
- replace
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
required:
- operation
- texts
application/transit+json:
schema:
type: object
properties:
operation:
type: string
enum:
- add
- remove
- replace
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
required:
- operation
- texts
application/edn:
schema:
type: object
properties:
operation:
type: string
enum:
- add
- remove
- replace
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
required:
- operation
- texts
required: true
/v2/investigation:
post:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/transit+msgpack:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/transit+json:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/edn:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
tags:
- v2
summary: Create Investigation
security:
- JWT-Bearer: []
- oauth2: []
requestBody:
content:
application/json:
schema:
type: object
properties:
observables:
title: ObservablesList
description: Observables that will be investigated
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
modules:
title: Modules
description: Module Ids that will be called during investigation for iroh-enrich.
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
time_window:
title: TimeWindow
description: A window of start_time to end_time to filter returned sightings.
type: object
properties:
start_time:
title: StartTime
description: Return events after this time.
type: string
format: date-time
example: '2026-08-18T22:03:32.803876481Z'
end_time:
title: EndTime
description: Will be used to filter Events that occurred before this time (defaults to now)
type: string
format: date-time
example: '2026-08-18T22:03:32.803889681Z'
required:
- start_time
source:
title: InvestigationSource
description: String with at most 1024 characters.
type: string
example: Cisco XDR Automated Question
title:
title: InvestigationTitle
description: String with at most 1024 characters.
type: string
example: Which devices in my org was this sha seen on?
description:
title: InvestigationDescription
description: String with at most 5000 characters.
type: string
example: 'For the following hashes:
- sha256:defg...1234
- sha256:abcd..1234
Determine which devices in my org have instances of the file in the past 30 days'
required:
- observables
application/transit+msgpack:
schema:
type: object
properties:
observables:
title: ObservablesList
description: Observables that will be investigated
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
modules:
title: Modules
description: Module Ids that will be called during investigation for iroh-enrich.
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
time_window:
title: TimeWindow
description: A window of start_time to end_time to filter returned sightings.
type: object
properties:
start_time:
title: StartTime
description: Return events after this time.
type: string
format: date-time
example: '2026-08-18T22:03:32.803876481Z'
end_time:
title: EndTime
description: Will be used to filter Events that occurred before this time (defaults to now)
type: string
format: date-time
example: '2026-08-18T22:03:32.803889681Z'
required:
- start_time
source:
title: InvestigationSource
description: String with at most 1024 characters.
type: string
example: Cisco XDR Automated Question
title:
title: InvestigationTitle
description: String with at most 1024 characters.
type: string
example: Which devices in my org was this sha seen on?
description:
title: InvestigationDescription
description: String with at most 5000 characters.
type: string
example: 'For the following hashes:
- sha256:defg...1234
- sha256:abcd..1234
Determine which devices in my org have instances of the file in the past 30 days'
required:
- observables
application/transit+json:
schema:
type: object
properties:
observables:
title: ObservablesList
description: Observables that will be investigated
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
modules:
title: Modules
description: Module Ids that will be called during investigation for iroh-enrich.
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
time_window:
title: TimeWindow
description: A window of start_time to end_time to filter returned sightings.
type: object
properties:
start_time:
title: StartTime
description: Return events after this time.
type: string
format: date-time
example: '2026-08-18T22:03:32.803876481Z'
end_time:
title: EndTime
description: Will be used to filter Events that occurred before this time (defaults to now)
type: string
format: date-time
example: '2026-08-18T22:03:32.803889681Z'
required:
- start_time
source:
title: InvestigationSource
description: String with at most 1024 characters.
type: string
example: Cisco XDR Automated Question
title:
title: InvestigationTitle
description: String with at most 1024 characters.
type: string
example: Which devices in my org was this sha seen on?
description:
title: InvestigationDescription
description: String with at most 5000 characters.
type: string
example: 'For the following hashes:
- sha256:defg...1234
- sha256:abcd..1234
Determine which devices in my org have instances of the file in the past 30 days'
required:
- observables
application/edn:
schema:
type: object
properties:
observables:
title: ObservablesList
description: Observables that will be investigated
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
modules:
title: Modules
description: Module Ids that will be called during investigation for iroh-enrich.
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
time_window:
title: TimeWindow
description: A window of start_time to end_time to filter returned sightings.
type: object
properties:
start_time:
title: StartTime
description: Return events after this time.
type: string
format: date-time
example: '2026-08-18T22:03:32.803876481Z'
end_time:
title: EndTime
description: Will be used to filter Events that occurred before this time (defaults to now)
type: string
format: date-time
example: '2026-08-18T22:03:32.803889681Z'
required:
- start_time
source:
title: InvestigationSource
description: String with at most 1024 characters.
type: string
example: Cisco XDR Automated Question
title:
title: InvestigationTitle
description: String with at most 1024 characters.
type: string
example: Which devices in my org was this sha seen on?
description:
title: InvestigationDescription
description: String with at most 5000 characters.
type: string
example: 'For the following hashes:
- sha256:defg...1234
- sha256:abcd..1234
Determine which devices in my org have instances of the file in the past 30 days'
required:
- observables
required: true
/v2/investigation/bundle:
post:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
created_threat_object_counts:
type: object
properties:
sightings:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
indicators:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
verdicts:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
judgements:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
malwares:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
tools:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
attack_patterns:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
assets:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- sightings
- indicators
- verdicts
- judgements
- malwares
- tools
- attack_patterns
- assets
required:
- investigation_id
- created_threat_object_counts
application/transit+msgpack:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
created_threat_object_counts:
type: object
properties:
sightings:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
indicators:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
verdicts:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
judgements:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
malwares:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
tools:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
attack_patterns:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
assets:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- sightings
- indicators
- verdicts
- judgements
- malwares
- tools
- attack_patterns
- assets
required:
- investigation_id
- created_threat_object_counts
application/transit+json:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
created_threat_object_counts:
type: object
properties:
sightings:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
indicators:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
verdicts:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
judgements:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
malwares:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
tools:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
attack_patterns:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
assets:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- sightings
- indicators
- verdicts
- judgements
- malwares
- tools
- attack_patterns
- assets
required:
- investigation_id
- created_threat_object_counts
application/edn:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
created_threat_object_counts:
type: object
properties:
sightings:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
indicators:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
verdicts:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
judgements:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
malwares:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
tools:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
attack_patterns:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
assets:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- sightings
- indicators
- verdicts
- judgements
- malwares
- tools
- attack_patterns
- assets
required:
- investigation_id
- created_threat_object_counts
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
tags:
- v2
summary: Create Investigation from Snapshot
security:
- JWT-Bearer: []
- oauth2: []
requestBody:
content:
application/json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- bundle
example: bundle
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
actors:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- actor
example: actor
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Indicates the time span for which the information about the Actor is relevant, and after which it could become outdated.
actor_types:
type: array
items:
type: string
example: Cyber Espionage Operations
example:
- Cyber Espionage Operations
identity:
type: object
properties:
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
related_identities:
type: array
items:
type: object
properties:
identity:
type: string
example: string
description: The reference (URI) of the related Identity object.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Specifies the level of confidence in the assertion of the relationship between the two objects.
information_source:
type: string
example: string
description: Specifies the source of the information about the relationship between the two components.
relationship:
type: string
example: string
required:
- identity
example:
identity: string
confidence: High
information_source: string
relationship: string
description: Describes a related Identity
example:
- identity: string
confidence: High
information_source: string
relationship: string
description: Identifies other entity Identities related to this Identity.
required:
- description
- related_identities
example:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
description: Can contain information such as the name of the attacker, the group or organization they belong to, or any other identifier that can help in the attribution process.
motivation:
type: string
example: Ego
description: The reason or purpose behind the malicious activity attributed to this Actor. By understanding a threat actor's motivation, analysts can better predict the attacker's behavior and anticipate future malicious actions.
sophistication:
type: string
enum:
- Aspirant
- Expert
- Innovator
- Novice
- Practitioner
example: Aspirant
description: "Represents the level of expertise and skill that the threat actor has displayed in their malicious activities. Can help security analysts assess the potential impact of an attacker's TTPs and determine the potential attack surface. \n\nFor example, a threat actor with a low sophistication level may primarily rely on off-the-shelf malware and attack tools, while an attacker with high sophistication may use custom tools with advanced evasion techniques, zero-day exploits, and sophisticated methods for command and control of their malware. \n\nThe sophistication level of an attacker can also be inferred based on several factors such as the complexity of attacks, the attacker's knowledge of the targeted organization's systems, and the attacker's ability to remain undetected.\n\nIf an attacker shows a high level of sophistication in reconnaissances, social engineering, and phishing, then the attacker may have a good knowledge of the targeted organization and its employees. This means that the attacker may be more successful in infiltrating the organization's network and compromising its systems."
intended_effect:
type: string
example: Account Takeover
description: "Represents the desired outcome or impact the threat actor is trying to achieve through their malicious activities. \n\n Helps security analysts to understand the attacker's goals beyond the immediate impact of the attack. By understanding the intended effect, analysts can draw connections between seemingly unrelated attacks and build a more complete understanding of an attacker's long-term goals and motivations."
planning_and_operational_support:
type: string
example: string
description: "Provides information about the resources and capabilities of the attacker that could be used to assist in planning and operations related to the threat.\n\n It can be used to describe Infrastructure, Tools, Techniques, and Capabilities used by the threat actor."
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'This field can help analysts decide how much trust they can put in the information provided by the threat intelligence sources.
For example, an Actor entity can have high confidence if the organization''s security researchers have been tracking it for a long time and have gathered a significant amount of intelligence about it through various sources, such as analysis of malware, network traffic, and human intelligence. In contrast, low confidence may indicate the organization has only seen limited or circumstantial evidence.'
aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: A list of other names that this Threat Actor is believed to use.
required:
- source
- title
- description
- short_description
example:
description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
description: Schema for submitting new Actors
uniqueItems: true
example:
- description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
description: a list of `NewActor`s.
assets:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset
example: asset
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: 'Specifies the time range during which the asset is considered valid or accurate.
For example, if an asset entity represents a device, the `valid_time` field could be used to indicate the period during which the device''s configuration information is deemed accurate.'
asset_type:
type: string
enum:
- application
- data
- device
- network
- person
example: application
description: 'Type of the Asset: Device, Person, Application, etc.'
required:
- source
- valid_time
- asset_type
example:
description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new Assets
uniqueItems: true
example:
- description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAsset`s.
asset_mappings:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset-mapping
example: asset-mapping
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: For each asset, we allow for the assertion of time bound properties.This gives us both a record of the current state of the asset,as well as history.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'Level of confidence held in the characterization of this AssetMapping e.g.: is it susceptible to manipulation or translation?'
specificity:
type: string
enum:
- Low
- Medium
- Unique
example: Low
description: Denotes the level of how many assets potentially could have this same identifier.
stability:
type: string
enum:
- Managed
- Physical
- Temporary
example: Managed
description: Do we manage when it changes, or is it always a time bound assignment?
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: An AssetMapping is a record that a specific Observable maps to an Asset for an indicated period of time.
asset_ref:
type: string
example: string
description: URI that points to the mapped Asset.
asset_type:
type: string
enum:
- application
- data
- device
- network
- person
example: application
description: 'Type of the mapped Asset: Device, Person, Application, etc.'
required:
- source
- valid_time
- confidence
- specificity
- stability
- observable
- asset_ref
- asset_type
example:
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
description: Schema for submitting new AssetMapping.
uniqueItems: true
example:
- asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
description: a list of `NewAssetMapping`s.
asset_properties:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset-properties
example: asset-properties
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which the AssetProperties is considered valid.
asset_ref:
type: string
example: string
description: URI that points to the associated Asset.
properties:
type: array
items:
type: object
properties:
name:
type: string
example: string
description: The properties are an open vocabulary.
value:
type: string
example: string
required:
- name
- value
example:
name: string
value: string
example:
- name: string
value: string
required:
- source
- valid_time
- asset_ref
example:
properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new AssetProperties
uniqueItems: true
example:
- properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAssetProperties`s.
attack_patterns:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- attack-pattern
example: attack-pattern
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: A kill chain is a series of steps that an attacker must go through to successfully achieve their objective. The concept was originally developed by the military, but has been adapted to the cybersecurity field to describe the steps an attacker goes through to compromise a target system and achieve their goal.
x_mitre_data_sources:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Data Sources.
x_mitre_platforms:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Platforms.
x_mitre_contributors:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Contributors.
abstraction_level:
type: string
enum:
- aggregate
- category
- detailed
- meta
- standard
example: aggregate
description: The CAPEC abstraction level for patterns describing techniques to attack a system.
required:
- title
- description
- short_description
example:
description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new AttackPattern
uniqueItems: true
example:
- description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAttackPattern`s.
campaigns:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- campaign
example: campaign
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Timestamp for the definition of a specific version of a campaign.
campaign_type:
type: string
example: string
description: 'String value that describes the type of campaign. For example, a campaign type could be ''Ransomware'', ''Advanced Persistent Threat'', ''Business Email Compromise'', ''Phishing'', etc. '
names:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Used to capture alternate names or aliases associated with the campaign. A cyberattack campaign may have multiple names or aliases depending on the group or actor(s) behind the attack, e.g., 'Wannacry' is also known as 'WannaCrypt', 'WCry', 'Wanna Decryptor', etc.
intended_effect:
type: array
items:
type: string
example: Account Takeover
example:
- Account Takeover
description: Characterizes the intended effect of this cyber threat campaign.
status:
type: string
enum:
- Future
- Historic
- Ongoing
example: Future
description: "Indicates current Status of the Campaign. \n\nCan have one of the following values: \n\n- Ongoing: Indicates that the campaign is currently active and ongoing. For example, a mass phishing campaign that is actively targeting users is considered 'ongoing'.\n\n- Historic: Campaign has already occurred and is now in the past.\n\n- Future: This indicates that a campaign is planned or expected to occur in the future. For example, a threat actor may announce their intention to launch a specific cyberattack campaign at a future date."
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Level of confidence held in the characterization of this Campaign.
activity:
type: array
items:
type: object
properties:
date_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Specifies the date and time at which the activity occured.
description:
type: string
example: string
description: A description of the activity.
required:
- date_time
- description
example:
date_time: '2016-01-01T01:01:01Z'
description: string
description: Captures the specific activities or tactics associated with the entity. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc.
example:
- date_time: '2016-01-01T01:01:01Z'
description: string
description: 'Used to capture specific activities or tactics associated with the campaign.
The ''activity'' field is an array of objects, and each element represents a specific activity and time associated with the campaign. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc. By capturing these activities analysts can identify the specific tactics used by the threat actor(s) behind the campaign.'
required:
- title
- description
- short_description
- campaign_type
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
description: Schema for submitting new Campaigns
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
description: a list of `NewCampaign`s.
coas:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- coa
example: coa
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
stage:
type: string
enum:
- Containment
- Eradication
- Identification
- Lessons Learned
- Preparation
- Recovery
- Remedy
- Response
example: Containment
description: Specifies what stage in the cyber threat management lifecycle this Course Of Action is relevant to.
coa_type:
type: string
enum:
- Diplomatic Actions
- Eradication
- Hardening
- Internal Blocking
- Logical Access Restrictions
- Monitoring
- Other
- Patching
- Perimeter Blocking
- Phase
- Physical Access Restrictions
- Playbook
- Policy Actions
- Public Disclosure
- Rebuilding
- Redirection
- Redirection (Honey Pot)
- Task
- Training
example: Diplomatic Actions
description: The type of this COA
objective:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Characterizes the objective to provide guidance on how to mitigate a security incident that has been identified.
impact:
type: string
example: string
description: Characterizes the estimated impact of applying this course of action.
cost:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Characterizes the estimated cost for applying this course of action.
efficacy:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Effectiveness of this course of action in achieving its targeted objective.
related_COAs:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
COA_id:
type: string
example: string
description: A URI leading to a COA.
required:
- COA_id
example:
confidence: High
source: string
relationship: string
COA_id: string
example:
- confidence: High
source: string
relationship: string
COA_id: string
description: Identifies or characterizes relationships to one or more related courses of action.
structured_coa_type:
type: string
enum:
- openc2
example: openc2
open_c2_coa:
type: object
properties:
type:
type: string
enum:
- structured_coa
example: structured_coa
id:
type: string
example: string
description: String with at most 1024 characters.
action:
type: object
properties:
type:
type: string
enum:
- alert
- allow
- augment
- contain
- delete
- deny
- detonate
- distill
- get
- investigate
- locate
- mitigate
- modify
- move
- notify
- other
- pause
- query
- redirect
- remediate
- report
- response
- restart
- restore
- resume
- save
- scan
- set
- snapshot
- start
- stop
- substitute
- sync
- throttle
- update
example: alert
required:
- type
example:
type: alert
target:
type: object
properties:
type:
type: string
example: acudid
specifiers:
type: string
example: string
description: Observable types that can be acted upon.
required:
- type
example:
type: acudid
specifiers: string
actuator:
type: object
properties:
type:
type: string
enum:
- endpoint
- endpoint.digital-telephone-handset
- endpoint.laptop
- endpoint.pos-terminal
- endpoint.printer
- endpoint.sensor
- endpoint.server
- endpoint.smart-meter
- endpoint.smart-phone
- endpoint.tablet
- endpoint.workstation
- network
- network.bridge
- network.firewall
- network.gateway
- network.guard
- network.hips
- network.hub
- network.ids
- network.ips
- network.modem
- network.nic
- network.proxy
- network.router
- network.security_manager
- network.sense_making
- network.sensor
- network.switch
- network.vpn
- network.wap
- other
- process
- process.aaa-server
- process.anti-virus-scanner
- process.connection-scanner
- process.directory-service
- process.dns-server
- process.email-service
- process.file-scanner
- process.location-service
- process.network-scanner
- process.remediation-service
- process.reputation-service
- process.sandbox
- process.virtualization-service
- process.vulnerability-scanner
example: endpoint
specifiers:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: List of additional properties describing the actuator.
required:
- type
example:
type: endpoint
specifiers:
- string
modifiers:
type: object
properties:
delay:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
duration:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
frequency:
type: string
example: string
description: String with at most 1024 characters.
id:
type: string
example: string
description: String with at most 1024 characters.
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
response:
type: string
enum:
- acknowledge
- command-ref
- query
- status
example: acknowledge
source:
type: string
example: string
description: String with at most 1024 characters.
destination:
type: string
enum:
- copy-to
- modify-to
- move-to
- report-to
- restore-point
- save-to
- set-to
example: copy-to
method:
type: array
items:
type: string
enum:
- acl
- authenticated
- blackhole
- blacklist
- graceful
- hibernate
- honeypot
- immediate
- segmentation
- spawn
- suspend
- unauthenticated
- whitelist
example: acl
example:
- acl
search:
type: string
enum:
- cve
- patch
- signature
- vendor_bulletin
example: cve
location:
type: string
enum:
- internal
- perimeter
example: internal
option:
type: string
example: string
description: String with at most 1024 characters.
additional_properties:
type: object
properties:
context:
type: string
example: string
description: String with at most 1024 characters.
required:
- context
example:
context: string
example:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
required:
- type
- action
example:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: Schema for submitting new COAs
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: a list of `NewCOA`s.
feedbacks:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- feedback
example: feedback
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
entity_id:
type: string
example: string
description: A URI leading to an entity.
feedback:
type: integer
enum:
- -1
- 0
- 1
example: -1
reason:
type: string
example: string
required:
- entity_id
- feedback
- reason
example:
feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new Feedback.
uniqueItems: true
example:
- feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewFeedback`s.
incidents:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- incident
example: incident
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'Represents the level of certainty or trustworthiness associated with the incident. It denotes the reliability of the intelligence associated with the incident.
The `confidence` field can take on several values, including:
- `info`: Indicates that the incident information is based on sources with no previous track record or there is no track record for the source reporting the incident.
- `low`: Indicates that the incident information is based on sources with a questionable track record or there is limited information about the accuracy of the source.
- `medium`: Indicates that the incident information is based on sources with a mixed track record or of uncertain reliability.
- `high`: Indicates that the incident information is based on sources with a proven track record and high degree of reliability.
The `confidence` field can be used to indicate the level of trust and confidence that can be attributed to the incident, and it may impact how the incident is prioritized, analyzed and addressed. It can also help in the decision-making process associated with the incident response activities.
It is important to note that the `confidence` field is subjective and can be interpreted differently by different organizations or analysts. As such, it is often used in conjunction with other intelligence attributes, such as the `severity` field, to provide a more complete picture of the incident.'
status:
type: string
enum:
- Closed
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Closed: Merged'
- 'Closed: Near-Miss'
- 'Closed: Other'
- 'Closed: Suspected'
- 'Closed: Under Review'
- Containment Achieved
- Hold
- 'Hold: External'
- 'Hold: Internal'
- 'Hold: Legal'
- Incident Reported
- New
- 'New: Presented'
- 'New: Processing'
- Open
- 'Open: Contained'
- 'Open: Investigating'
- 'Open: Recovered'
- 'Open: Reported'
- Rejected
- Restoration Achieved
- Stalled
example: Closed
description: The `status` field represents the current state of an incident within the incident management process. Its values help in tracking and reporting the progress of the incident from its discovery to its resolution.
incident_time:
type: object
properties:
opened:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first opened.
discovered:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first discovered.
reported:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first reported.
remediated:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the remediation of the damage from the incident was completed.
closed:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was last closed.
rejected:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was first rejected.
contained:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was first contained.
required:
- opened
example:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
description: Relevant time values associated with this Incident.
meta:
type: object
additionalProperties:
type: string
example: string
x-anyOf:
- type: string
example: string
- type: number
format: double
example: 10.0
- type: string
format: date-time
example: '2016-01-01T01:01:01Z'
- type: string
example: keyword
- type: boolean
example: true
example:
keyword: string
description: metadata associated to the incident.
properties: {}
scores:
type: object
additionalProperties:
type: number
format: double
example: 10.0
description: A non-negative score number.
example:
asset: 10.0
description: Used to indicate the severity or impact score of the threat represented by the incident.
properties: {}
categories:
type: array
items:
type: string
example: Attrition
example:
- Attrition
description: A set of categories for this incident.
discovery_method:
type: string
example: Agent Disclosure
description: Identifies how the incident was discovered.
intended_effect:
type: string
example: Account Takeover
description: Specifies the suspected intended effect of this incident
assignees:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: A set of owners assigned to this incident.
detection_sources:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: A set of sources that contributed threat detections to the incident.
promotion_method:
type: string
enum:
- Automated
- Manual
example: Automated
description: Describes method for promoting an Incident, whether manually or automatically. An Incident may be created manually by a SOAR analyst or SOC operator, or through an automated correlation or aggregation rule or engine that matches a specific set of events or alerts, and promotes them to Incident(s).
detection_status:
type: string
enum:
- active
- inactive_expired
- inactive_merged
- inactive_oversized
- inactive_user_closed
example: active
description: Represents the state of an incident within the incident generation process, indicating whether the incident is actively receiving updates or is no longer being updated.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
description: "Represents the potential impact of an incident on an organization's security posture and business operations. It helps organizations prioritize and allocate resources for incident response based on the severity level of the incident \nIt helps analysts and incident handlers prioritize incidents by indicating the level of risk and potential impact associated with the incident. This enables organizations to allocate resources efficiently and address the most critical incidents first.\nCan also be used to generate reports and metrics for measuring the effectiveness of the incident response process and to identify trends and patterns in the threat landscape.\nIt is important to note that the `severity` field is subjective and can be interpreted differently by different organizations or analysts. Therefore, it should be used in conjunction with other intelligence attributes, such as the `confidence` field, to provide a more comprehensive view of the incident."
tactics:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Represents the offensive techniques, approaches, or procedures that an adversary may use to achieve their objectives during an attack. It helps in understanding the intent and capabilities of the adversary and can be used to identify indicators of attack (IoAs) or indicators of compromise (IoCs) that are associated with the adversary's tactics.
techniques:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Represents the specific methods or actions used by an attacker to carry out an offensive maneuver or achieve their goals.
short_id:
type: string
example: string
description: A human-readable, short identifier for the incident, unique within an organization.
required:
- confidence
- status
- incident_time
example:
description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
description: For submitting a new Incident.
uniqueItems: true
example:
- description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
description: a list of `NewIncident`s.
indicators:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- indicator
example: indicator
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which this Indicator is considered valid.
producer:
type: string
example: string
description: String with at most 1024 characters.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
negate:
type: boolean
example: true
description: Specifies the absence of the pattern.
indicator_type:
type: array
items:
type: string
enum:
- Anonymization
- C2
- Compromised PKI Certificate
- Domain Watchlist
- Exfiltration
- File Hash Watchlist
- Host Characteristics
- IMEI Watchlist
- IMSI Watchlist
- IP Watchlist
- Login Name
- Malicious E-mail
- Malware Artifacts
- Private Threat Feed
- URL Watchlist
example: Anonymization
example:
- Anonymization
description: Specifies the type or types for this Indicator.
tags:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Descriptors for this indicator.
composite_indicator_expression:
type: object
properties:
operator:
type: string
enum:
- and
- not
- or
example: and
indicator_ids:
type: array
items:
type: string
example: string
description: A URI leading to an indicator.
example:
- string
required:
- operator
- indicator_ids
example:
operator: and
indicator_ids:
- string
likely_impact:
type: string
example: string
description: Likely potential impact within the relevant context if this Indicator were to occur.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: level of confidence held in the accuracy of this Indicator.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: Relevant kill chain phases indicated by this Indicator.
test_mechanisms:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
specification:
type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
x-anyOf:
- type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
- type: object
properties:
type:
type: string
enum:
- ThreatBrain
example: ThreatBrain
query:
type: string
example: string
variables:
type: array
items:
type: string
example: string
example:
- string
required:
- type
- variables
example:
type: ThreatBrain
query: string
variables:
- string
description: An indicator which runs in threatbrain...
- type: object
properties:
type:
type: string
enum:
- Snort
example: Snort
snort_sig:
type: string
example: string
required:
- type
- snort_sig
example:
type: Snort
snort_sig: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- SIOC
example: SIOC
SIOC:
type: string
example: string
required:
- type
- SIOC
example:
type: SIOC
SIOC: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- OpenIOC
example: OpenIOC
open_IOC:
type: string
example: string
required:
- type
- open_IOC
example:
type: OpenIOC
open_IOC: string
description: An indicator which contains an XML blob of an openIOC indicator.
required:
- producer
example:
description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: For submitting a new Indicator
uniqueItems: true
example:
- description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: a list of `NewIndicator`s.
judgements:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- judgement
example: judgement
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
disposition:
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Matches :disposition_name as in {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}
disposition_name:
type: string
enum:
- Clean
- Common
- Malicious
- Suspicious
- Unknown
example: Clean
description: String verdict identifiers.
priority:
type: integer
format: int64
example: 10
description: A value 0-100 that determine the priority of a judgement. Curated feeds of black/white lists, for example known good products within your organizations, should use a 95. All automated systems should use a priority of 90, or less. Human judgements should have a priority of 100, so that humans can always override machines.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
reason:
type: string
example: string
description: String with at most 1024 characters.
reason_uri:
type: string
example: string
description: A URI
required:
- source
- observable
- priority
- confidence
- severity
example:
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
description: Schema for submitting new Judgements.
uniqueItems: true
example:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
description: a list of `NewJudgement`s.
malwares:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- malware
example: malware
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
labels:
type: array
items:
type: string
example: adware
description: Malware label is an open vocabulary that represents different types and functions of malware. Malware labels are not mutually exclusive; a malware instance can be both spyware and a screen capture tool.
example:
- adware
description: The type of malware being described.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: The list of Kill Chain Phases for which this Malware can be used.
x_mitre_aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Software.aliases.
abstraction_level:
type: string
enum:
- family
- variant
- version
example: family
description: Malware abstraction level.
required:
- title
- description
- short_description
- labels
example:
description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new Malware.
uniqueItems: true
example:
- description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewMalware`s.
notes:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- note
example: note
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
note_class:
type: string
example: keyword
content:
type: string
example: string
description: Markdown string with at most 5000 characters.
related_entities:
type: array
items:
type: object
properties:
entity_type:
type: string
example: string
entity_id:
type: string
example: string
description: A URI leading to an entity.
required:
- entity_type
- entity_id
example:
entity_type: string
entity_id: string
example:
- entity_type: string
entity_id: string
author:
type: string
example: string
required:
- note_class
- content
- related_entities
example:
schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
description: Schema for submitting Notes
uniqueItems: true
example:
- schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
description: a list of `NewNote`s.
relationships:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- relationship
example: relationship
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
relationship_type:
type: string
example: attributed-to
source_ref:
type: string
example: string
description: A URI leading to an entity.
target_ref:
type: string
example: string
description: A URI leading to an entity.
required:
- relationship_type
- source_ref
- target_ref
example:
description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
description: Schema for submitting new Relationships.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
description: a list of `NewRelationship`s.
sightings:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- sighting
example: sighting
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
count:
type: integer
format: int64
example: 10
description: 'The number of times an indicator was observed within a certain period of time.
For example, if an IP address associated with known malicious activity is observed once within a period of time, it may indicate a low-level threat. However, if the same IP address is observed multiple times within a short time frame, it may indicate a more severe and persistent threat.
It can also be used to prioritize security alerts and indicate the urgency of a response. High counts indicate that an indicator is actively being used in a larger campaign, while low counts may indicate isolated incidents.'
internal:
type: boolean
example: false
description: "If `true`, indicates that the sighting was reported from internal sources, such as an organization's own internal security tools or SOC.\n Internal sightings are often considered more reliable and actionable than external sightings, which are reported from external sources and may have a lower level of trustworthiness. Internal sightings can provide more context and can help identify potential threats that are unique to a particular environment or organization.\n Internal sightings can also help organizations prioritize their security response efforts by identifying threats that are specific to their environment and may not yet be widely known."
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
resolution:
type: string
example: detected
description: Represents the disposition or actions taken on the associated threat intelligence.
data:
type: object
properties:
columns:
type: array
items:
type: object
properties:
name:
type: string
example: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
example: integer
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
type: boolean
example: true
description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`.
short_description:
type: string
example: string
required:
- name
- type
example:
name: string
type: integer
description: string
required: true
short_description: string
example:
- name: string
type: integer
description: string
required: true
short_description: string
description: an ordered list of column definitions
rows:
type: array
items:
type: array
items:
example: anything
example:
- - anything
description: an ordered list of rows
row_count:
type: integer
format: int64
example: 10
description: The number of rows in the data table.
required:
- columns
- rows
example:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: An embedded data table for the Sighting.
sensor:
type: string
example: endpoint
description: The OpenC2 Actuator name that best fits the device that is creating this sighting (e.g. network.firewall)
sensor_coordinates:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
os:
type: string
example: string
required:
- type
- observables
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
description: Describes the device that made the sighting (sensor) and contains identifying observables for the sensor.
targets:
type: array
items:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
os:
type: string
example: string
required:
- type
- observables
- observed_time
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
description: Describes the target of the sighting and contains identifying observables for the target.
example:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
description: 'May include one or more targets that observed the associated indicator. Targets can include network devices, host devices, or other entities that are capable of detecting indicators of compromise.
Can be used to assess the scope of potential threats, helping analysts understand which devices or components of the network may be vulnerable to attack. For example, if a particular malware strain is detected on several different systems within an organization, the `targets` field may indicate which systems are affected and which may need to be isolated or patched to prevent further spread.'
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
description: The object(s) of interest.
relations:
type: array
items:
type: object
properties:
origin:
type: string
example: string
origin_uri:
type: string
example: string
description: A URI
relation:
type: string
example: Allocated
relation_info:
type: object
additionalProperties:
example: anything
example:
keyword: anything
properties: {}
source:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
related:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
required:
- origin
- relation
- source
- related
example:
origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
description: A relation inside a Sighting.
example:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
description: Provide any context we can about where the observable came from.
context:
type: object
properties:
process_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- ProcessCreateEvent
example: ProcessCreateEvent
process_args:
type: string
example: string
description: String with at most 2048 characters.
process_hash:
type: string
example: string
description: String with at most 2048 characters.
process_size:
type: integer
format: int64
example: 10
process_disposition:
type: string
example: string
description: String with at most 1024 characters.
parent_creation_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
parent_process_id:
type: integer
format: int64
example: 10
parent_process_guid:
type: integer
format: int64
example: 10
parent_process_name:
type: string
example: string
description: String with at most 1024 characters.
parent_process_args:
type: string
example: string
description: String with at most 2048 characters.
parent_process_username:
type: string
example: string
description: String with at most 1024 characters.
parent_process_hash:
type: string
example: string
description: String with at most 2048 characters.
parent_process_size:
type: integer
format: int64
example: 10
parent_process_disposition:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- type
example:
parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
example:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
description: a list of `ProcessCreate`
library_load_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- LibraryLoadEvent
example: LibraryLoadEvent
dll_library_name:
type: string
example: string
description: String with at most 1024 characters.
dll_library_path:
type: string
example: string
description: String with at most 2048 characters.
required:
- time
- process_id
- process_name
- type
- dll_library_name
- dll_library_path
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
description: a list of `LibraryLoadType`
file_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileCreateEvent
example: FileCreateEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileCreateType`
file_delete_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileDeleteEvent
example: FileDeleteEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileDeleteType`
file_modify_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileModifyEvent
example: FileModifyEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileModifyType`
file_move_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileMoveEvent
example: FileMoveEvent
old_name:
type: string
example: string
description: String with at most 1024 characters.
new_name:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
- old_name
- new_name
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
description: a list of `FileMoveType`
netflow_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- NetflowEvent
example: NetflowEvent
traffic:
type: object
properties:
protocol:
type: integer
format: int64
example: 10
description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
source_ip:
type: string
example: string
destination_ip:
type: string
example: string
source_port:
type: integer
format: int64
example: 10
destination_port:
type: integer
format: int64
example: 10
direction:
type: string
enum:
- incoming
- outgoing
example: incoming
destination_host_name:
type: string
example: string
source_subnet:
type: string
example: string
destination_subnet:
type: string
example: string
required:
- protocol
- source_ip
- destination_ip
- source_port
- destination_port
- direction
example:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
process_path:
type: string
example: string
description: String with at most 1024 characters.
process_args:
type: string
example: string
description: String with at most 1024 characters.
process_hash:
type: string
example: string
description: String with at most 1024 characters.
process_account_type:
type: string
example: string
description: String with at most 1024 characters.
process_account:
type: string
example: string
description: String with at most 1024 characters.
parent_process_id:
type: integer
format: int64
example: 10
parent_process_name:
type: string
example: string
description: String with at most 1024 characters.
parent_process_path:
type: string
example: string
description: String with at most 1024 characters.
parent_process_args:
type: string
example: string
description: String with at most 1024 characters.
parent_process_hash:
type: string
example: string
description: String with at most 1024 characters.
parent_process_account:
type: string
example: string
description: String with at most 1024 characters.
parent_process_account_type:
type: string
example: string
description: String with at most 1024 characters.
flow_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
byte_count_out:
type: integer
format: int64
example: 10
byte_count_in:
type: integer
format: int64
example: 10
required:
- time
- process_id
- process_name
- type
- traffic
example:
parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
example:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
description: a list of `NetflowType`
http_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- HTTPEvent
example: HTTPEvent
host:
type: string
example: string
description: String with at most 1024 characters.
traffic:
type: object
properties:
protocol:
type: integer
format: int64
example: 10
description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
source_ip:
type: string
example: string
destination_ip:
type: string
example: string
source_port:
type: integer
format: int64
example: 10
destination_port:
type: integer
format: int64
example: 10
direction:
type: string
enum:
- incoming
- outgoing
example: incoming
destination_host_name:
type: string
example: string
source_subnet:
type: string
example: string
destination_subnet:
type: string
example: string
required:
- protocol
- source_ip
- destination_ip
- source_port
- destination_port
- direction
example:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
url_port:
type: integer
format: int64
example: 10
query:
type: string
example: string
description: String with at most 5000 characters.
encrypted:
type: boolean
example: true
method:
type: string
enum:
- CONNECT
- GET
- HEAD
- OPTIONS
- PATCH
- POST
- PUT
- TRACE
example: CONNECT
required:
- time
- process_id
- process_name
- type
- host
- traffic
example:
process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
example:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
description: a list of `HTTPType`
registry_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryCreateEvent
example: RegistryCreateEvent
required:
- time
- process_id
- process_name
- registry_key
- type
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
description: a list of `RegistryCreateType`
registry_set_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistrySetEvent
example: RegistrySetEvent
registry_value:
type: string
example: string
description: String with at most 2048 characters.
registry_data_length:
type: integer
format: int64
example: 10
registry_data:
type: string
example: string
description: String with at most 5000 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
- registry_value
example:
process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
example:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
description: a list of `RegistrySetType`
registry_delete_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryDeleteEvent
example: RegistryDeleteEvent
registry_value:
type: string
example: string
description: String with at most 2048 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
description: a list of `RegistryDeleteType`
registry_rename_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryRenameEvent
example: RegistryRenameEvent
registry_old_key:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
- registry_old_key
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
description: a list of `RegistryRenameType`
example:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
description: Context including the event type that best fits the type of the sighting.
activity_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the malicious activity occurred. For example, the time when a malware sample was executing, or the time range of a network intrusion.
detection_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the malicious activity was detected by the source engine or security tool. This may differ from the activity_interval if detection occurred after the activity.
modification_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the sighting record was created or last updated in the system.
required:
- observed_time
example:
description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: For submitting a new Sighting.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: a list of `NewSighting`s.
identity_assertions:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- identity-assertion
example: identity-assertion
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
identity:
type: object
properties:
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
required:
- observables
example:
observables:
- value: 1.2.3.4
type: ip
description: Attributes for which the assertion is being made.
assertions:
type: array
items:
type: object
properties:
name:
type: string
example: cisco:ctr:ad:host_domain_name
description: An open vocabulary containing well known assertion types
value:
type: string
example: string
required:
- name
- value
example:
name: cisco:ctr:ad:host_domain_name
value: string
example:
- name: cisco:ctr:ad:host_domain_name
value: string
description: Any known context about the identity attributes.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- identity
- assertions
example:
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
description: For submitting a new IdentityAssertion.
uniqueItems: true
example:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
description: a list of `NewIdentityAssertion`s.
target_records:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- target-record
example: target-record
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
targets:
type: array
items:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
os:
type: string
example: string
description: Source Operating System where TargetRecord was originated.
internal:
type: boolean
example: false
description: Is it internal to our network?
sensor:
type: string
example: string
description: 'The OpenC2 Actuator name that best fits the device that is creating this TargetRecord (e.g.: network.firewall, etc.)'
source_uri:
type: string
example: string
description: A URI
required:
- type
- observables
- observed_time
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
description: Schema for TargetRecord Targets
example:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
required:
- source
- targets
example:
description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new TargetRecord.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewTargetRecord`s.
tools:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- tool
example: tool
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
labels:
type: array
items:
type: string
example: credential-exploitation
description: Tool labels describe the categories of tools that can be used to perform attacks.
example:
- credential-exploitation
description: The kind(s) of tool(s) being described.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: The list of kill chain phases for which this Tool can be used.
tool_version:
type: string
example: string
description: The version identifier associated with the Tool.
x_mitre_aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Software.aliases.
required:
- title
- description
- short_description
- labels
example:
description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new Tool.
uniqueItems: true
example:
- description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewTool`s.
verdicts:
type: array
items:
type: object
properties:
type:
type: string
enum:
- verdict
example: verdict
disposition:
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Numeric verdict identifiers.
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
disposition_name:
type: string
enum:
- Clean
- Common
- Malicious
- Suspicious
- Unknown
example: Clean
description: 'The disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}'
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- type
- disposition
- observable
- valid_time
example:
type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: "A Verdict is chosen from all of the Judgements on that Observable which have not yet expired. The highest priority Judgement becomes the active verdict. If there is more than one Judgement with that priority, then Clean disposition has priority over all others, then Malicious disposition, and so on down to Unknown.\n\n The ID of a verdict is a a str of the form \"observable.type:observable.value\" for example, \"ip:1.1.1.1\""
uniqueItems: true
example:
- type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: a list of `Verdict`s.
data_tables:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- data-table
example: data-table
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
columns:
type: array
items:
type: object
properties:
name:
type: string
example: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
example: integer
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
type: boolean
example: true
description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`.
short_description:
type: string
example: string
required:
- name
- type
example:
name: string
type: integer
description: string
required: true
short_description: string
example:
- name: string
type: integer
description: string
required: true
short_description: string
description: An ordered list of column definitions.
rows:
type: array
items:
type: array
items:
example: anything
example:
- - anything
description: An ordered list of rows
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
row_count:
type: integer
format: int64
example: 10
description: The number of rows in the data table.
required:
- columns
- rows
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting a NewDataTable record.
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewDataTable`s.
weaknesses:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- weakness
example: weakness
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: Should be short and limited to the key points that define this weakness.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
structure:
type: string
enum:
- Chain
- Composite
- Simple
example: Chain
description: Defines the structural nature of the weakness.
languages:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Language name (Clojure, Java, ...)
class:
type: string
example: Assembly
description: Class of language.
required:
- prevalence
example:
prevalence: Often
name: string
class: Assembly
example:
- prevalence: Often
name: string
class: Assembly
description: Applicable Languages.
operating_systems:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: String with at most 1024 characters.
version:
type: string
example: string
description: String with at most 1024 characters.
cpe_id:
type: string
example: string
description: String with at most 1024 characters.
class:
type: string
example: Android
description: Class of Operating System.
required:
- prevalence
example:
prevalence: Often
name: string
version: string
cpe_id: string
class: Android
example:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
description: Applicable operating systems.
architectures:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Architecture name (ARM, x86, ...)
class:
type: string
example: Embedded
description: Class of architecture
required:
- prevalence
example:
prevalence: Often
name: string
class: Embedded
example:
- prevalence: Often
name: string
class: Embedded
description: Applicable architectures.
paradigms:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Paradigm name (Client Server, Mainframe)
required:
- prevalence
example:
prevalence: Often
name: string
example:
- prevalence: Often
name: string
description: Applicable paradigms.
technologies:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Technology name (Web Server, Web Client)
required:
- prevalence
example:
prevalence: Often
name: string
example:
- prevalence: Often
name: string
description: Applicable technologies.
background_details:
type: string
example: string
description: Information that is relevant but not related to the nature of the weakness itself.
alternate_terms:
type: array
items:
type: object
properties:
term:
type: string
example: string
description: The actual alternate term.
description:
type: string
example: string
description: Provides context for the alternate term by which this weakness may be known.
required:
- term
example:
term: string
description: string
example:
- term: string
description: string
description: Indicates one or more other names used to describe this weakness.
modes_of_introduction:
type: array
items:
type: object
properties:
phase:
type: string
example: Architecture and Design
description: Identifies the point in the software life cycle at which the weakness may be introduced.
note:
type: string
example: string
description: Provides a typical scenario related to introduction during the given phase.
required:
- phase
example:
phase: Architecture and Design
note: string
example:
- phase: Architecture and Design
note: string
description: Information about how and when a given weakness may be introduced.
likelihood:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Likelihood of exploit.
common_consequences:
type: array
items:
type: object
properties:
scopes:
type: array
items:
type: string
example: Access Control
description: Defines the different areas of software security that can be affected by exploiting a weakness.
example:
- Access Control
description: Identifies the security property that is violated.
impacts:
type: array
items:
type: string
example: Alter Execution Logic
example:
- Alter Execution Logic
description: Describes the technical impact that arises if an adversary succeeds in exploiting this weakness.
likelihood:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: How likely the specific consequence is expected to be seen relative to the other consequences.
note:
type: string
example: string
description: Additional commentary about a consequence.
required:
- scopes
example:
scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
example:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
description: Refers to the typical or expected negative effects that can result from exploiting the weakness. This could include anything from unauthorized access to data, denial of service, system crashes or other things.
detection_methods:
type: array
items:
type: object
properties:
method:
type: string
example: Architecture or Design Review
description: Identifies the particular detection method being described.
description:
type: string
example: string
description: Provides some context of how this method can be applied to a specific weakness.
effectiveness:
type: string
example: High
description: How effective the detection method may be in detecting the associated weakness.
effectiveness_notes:
type: string
example: string
description: Provides additional discussion of the strengths and shortcomings of this detection method.
required:
- method
- description
example:
method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
example:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
description: Identifies methods that may be employed to detect this weakness, including their strengths and limitations.
potential_mitigations:
type: array
items:
type: object
properties:
description:
type: string
example: string
description: A description of this individual mitigation including any strengths and shortcomings of this mitigation for the weakness.
phases:
type: array
items:
type: string
example: Architecture and Design
description: Defines the different regularities that guide the applicability of platforms.
example:
- Architecture and Design
description: Indicates the development life cycle phase during which this particular mitigation may be applied.
strategy:
type: string
example: Attack Surface Reduction
description: A general strategy for protecting a system to which this mitigation contributes.
effectiveness:
type: string
example: Defense in Depth
description: Summarizes how effective the mitigation may be in preventing the weakness.
effectiveness_notes:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
- description
example:
description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
example:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
description: Describes potential mitigations associated with a weakness.
functional_areas:
type: array
items:
type: string
example: Authentication
description: Defines the different functional areas of software in which the weakness may appear.
example:
- Authentication
description: Identifies the functional area of the software in which the weakness is most likely to occur.
affected_resources:
type: array
items:
type: string
example: CPU
description: Defines a resource of a system.
example:
- CPU
description: Identifies system resources that can be affected by an exploit of this weakness.
notes:
type: array
items:
type: object
properties:
type:
type: string
example: Applicable Platform
description: Defines the different types of notes that can be associated with a weakness.
note:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
- type
- note
example:
type: Applicable Platform
note: string
example:
- type: Applicable Platform
note: string
description: Provides any additional comments about the weakness.
abstraction_level:
type: string
enum:
- Base
- Class
- Compound
- Variant
example: Base
description: Refers to the level of abstraction or granularity used to describe the weakness. It helps to categorize the vulnerability based on the level of detail provided.
required:
- description
example:
description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
description: For submitting a new weakness.
uniqueItems: true
example:
- description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
description: a list of `NewWeakness`s.
vulnerabilities:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- vulnerability
example: vulnerability
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: "Various sources of vulnerability information can be used, including third-party resources like the National Vulnerability Database (NVD) and the Common Vulnerabilities and Exposures (CVE) database. The platform then analyzes this data and provides the user with relevant details such as the severity of the vulnerability, the affected systems, and remediation recommendations. \n\n Based on this information, the user can prioritize patching and other mitigation strategies to reduce the risk of potential attacks."
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
cve:
type: object
properties:
cve_data_meta:
type: object
properties:
id:
type: string
example: string
description: String with at most 1024 characters.
assigner:
type: string
example: string
description: String with at most 1024 characters.
example:
id: string
assigner: string
required:
- cve_data_meta
example:
cve_data_meta:
id: string
assigner: string
impact:
type: object
properties:
cvss_v2:
type: object
properties:
vector_string:
type: string
example: string
description: a text representation of a set of CVSSv2 metrics. It is commonly used to record or transfer CVSSv2 metric information in a concise form
base_score:
type: number
format: double
example: 10.0
description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v2/guide'
base_severity:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
impact_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
exploitability_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
access_vector:
type: string
enum:
- adjacent network
- local
- network
example: network
description: This metric reflects how the vulnerability is exploited.The more remote an attacker can be to attack a host, the greater the vulnerability score.
access_complexity:
type: string
enum:
- high
- low
- medium
example: low
description: 'This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system. For example, consider a buffer overflow in an Internet service: once the target system is located, the attacker can launch an exploit at will.'
authentication:
type: string
enum:
- multiple
- none
- single
example: none
description: This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. This metric does not gauge the strength or complexity of the authentication process, only that an attacker is required to provide credentials before an exploit may occur. The fewer authentication instances that are required, the higher the vulnerability score.
confidentiality_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact on confidentiality of a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. Increasedconfidentiality impact increases the vulnerability score.
integrity_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information. Increased integrity impact increases the vulnerability score.
availability_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact to availability of a successfully exploited vulnerability. Availability refers to the accessibility of information resources. Attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system. Increased availability impact increases the vulnerability score.
exploitability:
type: string
enum:
- functional
- high
- not_defined
- proof_of_concept
- unproven
example: not_defined
description: This metric measures the current state of exploit techniques or code availability. Public availability of easy-to-use exploit code increases the number of potential attackers by including those who are unskilled thereby increasing the severity of the vulnerability.
remediation_level:
type: string
enum:
- not_defined
- official_fix
- temporary_fix
- unavailable
- workaround
example: not_defined
description: The remediation level of a vulnerability is an important factor for prioritization. The typical vulnerability is unpatched when initially published. Workarounds or hotfixes may offer interim remediation until an official patch or upgrade is issued. Each of these respective stages adjusts the temporal score downwards, reflecting the decreasing urgency as remediation becomes final. The less official and permanent a fix, the higher the vulnerability score is.
report_confidence:
type: string
enum:
- confirmed
- not_defined
- unconfirmed
- uncorroborated
example: not_defined
description: This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details. Sometimes, only the existence of vulnerabilities are publicized, but without specific details. The vulnerability may later be corroborated and then confirmed through acknowledgement by the author or vendor of the affected technology. The urgency of a vulnerability is higher when a vulnerability is known to exist with certainty. This metric also suggests the level of technical knowledge available to would-be attackers. The more a vulnerability is validated by the vendor or other reputable sources, the higher the score.
temporal_vector_string:
type: string
example: string
description: A text representation of a set of CVSSv2 temporal metrics. Temporal metrics allow analysists to calculate threat severity based on temporal factors such as reliability of vulnerability reports, availability of mitigations, and the ease or difficulty of conducting the exploit. It is commonly used to record or transfer CVSSv2 metric information in a concise form
collateral_damage_potential:
type: string
enum:
- high
- low
- low_medium
- medium_high
- none
- not_defined
example: not_defined
description: This metric measures the potential for loss of life or physical assets through damage or theft of property or equipment. The metric may also measure economic loss of productivity or revenue. Naturally, the greater the damage potential, the higher the vulnerability score.
target_distribution:
type: string
enum:
- high
- low
- medium
- none
- not_defined
example: not_defined
description: This metric measures the proportion of vulnerable systems. It is meant as an environment-specific indicator in order to approximate the percentage of systems that could be affected by the vulnerability. The greater the proportion of vulnerable systems, the higher the score.
confidentiality_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
integrity_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
availability_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
environmental_vector_string:
type: string
example: string
description: A text representation of a set of CVSSv2 environmental metrics. Environmental metrics allow analysists to calculate threat scores in relation to environmental security requirements, collateral damage potential, and target availability. It is commonly used to record or transfer CVSSv2 metric information in a concise form
obtain_all_privilege:
type: boolean
example: true
obtain_user_privilege:
type: boolean
example: true
obtain_other_privilege:
type: boolean
example: true
user_interaction_required:
type: boolean
example: true
required:
- vector_string
- base_score
- base_severity
example:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
type: object
properties:
vector_string:
type: string
example: string
description: a text representation of a set of CVSSv3 metrics. It is commonly used to record or transfer CVSSv3 metric information in a concise form
base_score:
type: number
format: double
example: 10.0
description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v3-1'
base_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
impact_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
exploitability_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
attack_vector:
type: string
enum:
- adjacent_network
- local
- network
- physical
example: adjacent_network
description: Reflects the context by which vulnerability exploitation is possible
modified_attack_vector:
type: string
enum:
- adjacent_network
- local
- network
- not_defined
- physical
example: not_defined
description: modified attack vector
attack_complexity:
type: string
enum:
- high
- low
example: high
description: describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability
modified_attack_complexity:
type: string
enum:
- high
- low
- not_defined
example: not_defined
description: modified attack complexity
privileges_required:
type: string
enum:
- high
- low
- none
example: high
description: describes the level of privileges an attacker must possess before successfully exploiting the vulnerability
modified_privileges_required:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified privileges required
user_interaction:
type: string
enum:
- none
- required
example: none
description: captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component
modified_user_interaction:
type: string
enum:
- none
- not_defined
- required
example: none
description: modified user interaction
scope:
type: string
enum:
- changed
- unchanged
example: changed
description: the ability for a vulnerability in one software component to impact resources beyond its means, or privileges
modified_scope:
type: string
enum:
- changed
- not_defined
- unchanged
example: not_defined
description: modified scope
confidentiality_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability
modified_confidentiality_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified confidentiality impact
integrity_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to integrity of a successfully exploited vulnerability
modified_integrity_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified integrity impact
availability_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability
modified_availability_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified availability impact
exploit_code_maturity:
type: string
enum:
- functional
- high
- not_defined
- proof_of_concept
- unproven
example: functional
description: measures the likelihood of the vulnerability being attacked
remediation_level:
type: string
enum:
- high
- not_defined
- offical_fix
- temporary_fix
- unavailable
- workaround
example: high
description: Remediation Level of a vulnerability is an important factor for prioritization
report_confidence:
type: string
enum:
- confirmed
- reasonable
- unknown
example: confirmed
description: measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details
temporal_score:
type: number
format: double
example: 10.0
description: Round up(CVSSv3BaseScore × CVSSv3ExploitCodeMaturity × CVSSv3RemediationLevel × CVSSv3ReportConfidence)
temporal_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
description: temporal severity
availability_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
confidentiality_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
integrity_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
environmental_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
environmental_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
required:
- vector_string
- base_score
- base_severity
example:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
example:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: "Describes the potential impact of a vulnerability that is being tracked in the system. Provides information on the extent of damage that a vulnerability can cause and how serious the consequences could be if it is exploited. \n\nMay contain granular information about the vulnerability severity using the CVSS system, versions 2 and 3.\n\nCVSSv2 and CVSSv3 have different methods of calculating base scores, but both are designed to provide an indication of the level of risk that a vulnerability poses. The base score ranges from 0 to 10, with 10 being the most severe. Additionally, both CVSSv2 and CVSSv3 define severity levels, such as low, medium, high, and critical, based on the base score."
configurations:
type: object
properties:
CVE_data_version:
type: string
example: string
description: Specifies the version of the CVE (Common Vulnerabilities and Exposures) dictionary used by the vulnerability information provider.
nodes:
type: array
items:
type: object
properties:
operator:
type: string
enum:
- AND
- OR
example: AND
description: The operator string influences how seqs of cpe matches are related to one another.
cpe_match:
type: array
items:
type: object
properties:
vulnerable:
type: boolean
example: true
cpe23Uri:
type: string
example: string
description: A text representation of a software or hardware platform.
versionStartIncluding:
type: string
example: string
description: A string representing the lower bound(inclusive) of version in the CPE.
versionEndIncluding:
type: string
example: string
description: A string representing the upper bound(inclusive) of version in the CPE.
versionStartExcluding:
type: string
example: string
description: A string representing the lower bound(exclusive) of version in the CPE.
versionEndExcluding:
type: string
example: string
description: A string representing the upper bound(exclusive) of version in the CPE.
required:
- vulnerable
- cpe23Uri
example:
vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
example:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
type: array
items:
type: object
properties:
operator:
type: string
enum:
- AND
- OR
example: AND
description: The operator string influences how seqs of cpe matches are related to one another.
cpe_match:
type: array
items:
type: object
properties:
vulnerable:
type: boolean
example: true
cpe23Uri:
type: string
example: string
description: A text representation of a software or hardware platform.
versionStartIncluding:
type: string
example: string
description: A string representing the lower bound(inclusive) of version in the CPE.
versionEndIncluding:
type: string
example: string
description: A string representing the upper bound(inclusive) of version in the CPE.
versionStartExcluding:
type: string
example: string
description: A string representing the lower bound(exclusive) of version in the CPE.
versionEndExcluding:
type: string
example: string
description: A string representing the upper bound(exclusive) of version in the CPE.
required:
- vulnerable
- cpe23Uri
example:
vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
example:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate:
type: boolean
example: true
description: Negates operator when true.
required:
- operator
- cpe_match
example:
operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
example:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate:
type: boolean
example: true
description: Negates operator when true.
required:
- operator
example:
operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
example:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
description: Each `node` in the CTIM standard configuration includes information such as the `operator` (such as "less than", or "greater than or equal to"), and the `cpe` (Common Platform Enumeration) string which identifies the specific software, `CPE` is a structured naming scheme for IT systems, platforms, and software packages, and it is instrumental in enabling data exchange between different systems.
required:
- CVE_data_version
- nodes
example:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
description: "Represents a list of affected versions or configurations of a software component that is impacted by a vulnerability. \nBy tracking the affected software components and versions, defenders can identify which systems are potentially exposed to an attack, and apply appropriate mitigations."
published_date:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: "Represents the date when a vulnerability was publicly disclosed or made available to the general public. \n\nImportant for tracking the age of a vulnerability, as well as for determining when a particular vulnerability was first introduced into a system. The published date can be used to identify the time window during which a system may have been vulnerable to a particular exploit.\n\nFor example, if an organization discovers that a vulnerability was published before their system's installation date, but they did not apply the necessary security updates in a timely manner, it can be concluded that their system was vulnerable for the period between the installation date and the date when the necessary security updates were applied."
last_modified_date:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: 'Represents the date when the vulnerability metadata was last updated in the internal database.
It can be used to track the freshness of the vulnerability information. If the `last_modified_date` is more recent than the `published_date`, it can indicate that there has been some new information or updates related to the vulnerability, such as new patch releases or changes in the severity or impact rating.'
required:
- description
example:
description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: For submitting a new vulnerability.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: a list of `NewVulnerability`s.
actor_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_mapping_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_properties_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
attack_pattern_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
campaign_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
coa_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
feedback_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
identity_assertion_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
incident_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
indicator_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
judgement_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
malware_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
note_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
relationship_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
sighting_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
target_record_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
tool_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
verdict_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
data_table_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
weakness_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
vulnerability_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- source
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
asset_mapping_refs:
- string
note_refs:
- string
data_table_refs:
- string
attack_pattern_refs:
- string
sighting_refs:
- string
schema_version: 1.3.30
revision: 10
assets:
- description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
weakness_refs:
- string
tool_refs:
- string
target_record_refs:
- string
asset_refs:
- string
tools:
- description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
indicators:
- description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
attack_patterns:
- description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
type: bundle
weaknesses:
- description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
source: string
external_ids:
- string
feedback_refs:
- string
asset_properties:
- properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
short_description: string
feedbacks:
- feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
judgement_refs:
- string
title: string
coa_refs:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
verdicts:
- type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
campaigns:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
source_uri: string
actors:
- description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
indicator_refs:
- string
actor_refs:
- string
language: string
data_tables:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
id: string
notes:
- schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
identity_assertions:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
judgements:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
malwares:
- description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
target_records:
- description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
asset_mappings:
- asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
relationship_refs:
- string
tlp: green
incidents:
- description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
identity_assertion_refs:
- string
sightings:
- description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
campaign_refs:
- string
vulnerability_refs:
- string
asset_properties_refs:
- string
relationships:
- description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
timestamp: '2016-01-01T01:01:01Z'
verdict_refs:
- string
malware_refs:
- string
incident_refs:
- string
vulnerabilities:
- description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
coas:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: Describes a Bundle of any set of CTIM entities.
investigated_observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
source:
title: InvestigationSource
description: String with at most 1024 characters.
type: string
example: Cisco XDR Automated Question
title:
title: InvestigationTitle
description: String with at most 1024 characters.
type: string
example: Which devices in my org was this sha seen on?
description:
title: InvestigationDescription
description: String with at most 5000 characters.
type: string
example: 'For the following hashes:
- sha256:defg...1234
- sha256:abcd..1234
Determine which devices in my org have instances of the file in the past 30 days'
required:
- bundle
application/transit+msgpack:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- bundle
example: bundle
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
actors:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- actor
example: actor
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Indicates the time span for which the information about the Actor is relevant, and after which it could become outdated.
actor_types:
type: array
items:
type: string
example: Cyber Espionage Operations
example:
- Cyber Espionage Operations
identity:
type: object
properties:
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
related_identities:
type: array
items:
type: object
properties:
identity:
type: string
example: string
description: The reference (URI) of the related Identity object.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Specifies the level of confidence in the assertion of the relationship between the two objects.
information_source:
type: string
example: string
description: Specifies the source of the information about the relationship between the two components.
relationship:
type: string
example: string
required:
- identity
example:
identity: string
confidence: High
information_source: string
relationship: string
description: Describes a related Identity
example:
- identity: string
confidence: High
information_source: string
relationship: string
description: Identifies other entity Identities related to this Identity.
required:
- description
- related_identities
example:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
description: Can contain information such as the name of the attacker, the group or organization they belong to, or any other identifier that can help in the attribution process.
motivation:
type: string
example: Ego
description: The reason or purpose behind the malicious activity attributed to this Actor. By understanding a threat actor's motivation, analysts can better predict the attacker's behavior and anticipate future malicious actions.
sophistication:
type: string
enum:
- Aspirant
- Expert
- Innovator
- Novice
- Practitioner
example: Aspirant
description: "Represents the level of expertise and skill that the threat actor has displayed in their malicious activities. Can help security analysts assess the potential impact of an attacker's TTPs and determine the potential attack surface. \n\nFor example, a threat actor with a low sophistication level may primarily rely on off-the-shelf malware and attack tools, while an attacker with high sophistication may use custom tools with advanced evasion techniques, zero-day exploits, and sophisticated methods for command and control of their malware. \n\nThe sophistication level of an attacker can also be inferred based on several factors such as the complexity of attacks, the attacker's knowledge of the targeted organization's systems, and the attacker's ability to remain undetected.\n\nIf an attacker shows a high level of sophistication in reconnaissances, social engineering, and phishing, then the attacker may have a good knowledge of the targeted organization and its employees. This means that the attacker may be more successful in infiltrating the organization's network and compromising its systems."
intended_effect:
type: string
example: Account Takeover
description: "Represents the desired outcome or impact the threat actor is trying to achieve through their malicious activities. \n\n Helps security analysts to understand the attacker's goals beyond the immediate impact of the attack. By understanding the intended effect, analysts can draw connections between seemingly unrelated attacks and build a more complete understanding of an attacker's long-term goals and motivations."
planning_and_operational_support:
type: string
example: string
description: "Provides information about the resources and capabilities of the attacker that could be used to assist in planning and operations related to the threat.\n\n It can be used to describe Infrastructure, Tools, Techniques, and Capabilities used by the threat actor."
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'This field can help analysts decide how much trust they can put in the information provided by the threat intelligence sources.
For example, an Actor entity can have high confidence if the organization''s security researchers have been tracking it for a long time and have gathered a significant amount of intelligence about it through various sources, such as analysis of malware, network traffic, and human intelligence. In contrast, low confidence may indicate the organization has only seen limited or circumstantial evidence.'
aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: A list of other names that this Threat Actor is believed to use.
required:
- source
- title
- description
- short_description
example:
description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
description: Schema for submitting new Actors
uniqueItems: true
example:
- description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
description: a list of `NewActor`s.
assets:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset
example: asset
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: 'Specifies the time range during which the asset is considered valid or accurate.
For example, if an asset entity represents a device, the `valid_time` field could be used to indicate the period during which the device''s configuration information is deemed accurate.'
asset_type:
type: string
enum:
- application
- data
- device
- network
- person
example: application
description: 'Type of the Asset: Device, Person, Application, etc.'
required:
- source
- valid_time
- asset_type
example:
description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new Assets
uniqueItems: true
example:
- description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAsset`s.
asset_mappings:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset-mapping
example: asset-mapping
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: For each asset, we allow for the assertion of time bound properties.This gives us both a record of the current state of the asset,as well as history.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'Level of confidence held in the characterization of this AssetMapping e.g.: is it susceptible to manipulation or translation?'
specificity:
type: string
enum:
- Low
- Medium
- Unique
example: Low
description: Denotes the level of how many assets potentially could have this same identifier.
stability:
type: string
enum:
- Managed
- Physical
- Temporary
example: Managed
description: Do we manage when it changes, or is it always a time bound assignment?
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: An AssetMapping is a record that a specific Observable maps to an Asset for an indicated period of time.
asset_ref:
type: string
example: string
description: URI that points to the mapped Asset.
asset_type:
type: string
enum:
- application
- data
- device
- network
- person
example: application
description: 'Type of the mapped Asset: Device, Person, Application, etc.'
required:
- source
- valid_time
- confidence
- specificity
- stability
- observable
- asset_ref
- asset_type
example:
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
description: Schema for submitting new AssetMapping.
uniqueItems: true
example:
- asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
description: a list of `NewAssetMapping`s.
asset_properties:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset-properties
example: asset-properties
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which the AssetProperties is considered valid.
asset_ref:
type: string
example: string
description: URI that points to the associated Asset.
properties:
type: array
items:
type: object
properties:
name:
type: string
example: string
description: The properties are an open vocabulary.
value:
type: string
example: string
required:
- name
- value
example:
name: string
value: string
example:
- name: string
value: string
required:
- source
- valid_time
- asset_ref
example:
properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new AssetProperties
uniqueItems: true
example:
- properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAssetProperties`s.
attack_patterns:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- attack-pattern
example: attack-pattern
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: A kill chain is a series of steps that an attacker must go through to successfully achieve their objective. The concept was originally developed by the military, but has been adapted to the cybersecurity field to describe the steps an attacker goes through to compromise a target system and achieve their goal.
x_mitre_data_sources:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Data Sources.
x_mitre_platforms:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Platforms.
x_mitre_contributors:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Contributors.
abstraction_level:
type: string
enum:
- aggregate
- category
- detailed
- meta
- standard
example: aggregate
description: The CAPEC abstraction level for patterns describing techniques to attack a system.
required:
- title
- description
- short_description
example:
description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new AttackPattern
uniqueItems: true
example:
- description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAttackPattern`s.
campaigns:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- campaign
example: campaign
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Timestamp for the definition of a specific version of a campaign.
campaign_type:
type: string
example: string
description: 'String value that describes the type of campaign. For example, a campaign type could be ''Ransomware'', ''Advanced Persistent Threat'', ''Business Email Compromise'', ''Phishing'', etc. '
names:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Used to capture alternate names or aliases associated with the campaign. A cyberattack campaign may have multiple names or aliases depending on the group or actor(s) behind the attack, e.g., 'Wannacry' is also known as 'WannaCrypt', 'WCry', 'Wanna Decryptor', etc.
intended_effect:
type: array
items:
type: string
example: Account Takeover
example:
- Account Takeover
description: Characterizes the intended effect of this cyber threat campaign.
status:
type: string
enum:
- Future
- Historic
- Ongoing
example: Future
description: "Indicates current Status of the Campaign. \n\nCan have one of the following values: \n\n- Ongoing: Indicates that the campaign is currently active and ongoing. For example, a mass phishing campaign that is actively targeting users is considered 'ongoing'.\n\n- Historic: Campaign has already occurred and is now in the past.\n\n- Future: This indicates that a campaign is planned or expected to occur in the future. For example, a threat actor may announce their intention to launch a specific cyberattack campaign at a future date."
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Level of confidence held in the characterization of this Campaign.
activity:
type: array
items:
type: object
properties:
date_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Specifies the date and time at which the activity occured.
description:
type: string
example: string
description: A description of the activity.
required:
- date_time
- description
example:
date_time: '2016-01-01T01:01:01Z'
description: string
description: Captures the specific activities or tactics associated with the entity. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc.
example:
- date_time: '2016-01-01T01:01:01Z'
description: string
description: 'Used to capture specific activities or tactics associated with the campaign.
The ''activity'' field is an array of objects, and each element represents a specific activity and time associated with the campaign. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc. By capturing these activities analysts can identify the specific tactics used by the threat actor(s) behind the campaign.'
required:
- title
- description
- short_description
- campaign_type
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
description: Schema for submitting new Campaigns
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
description: a list of `NewCampaign`s.
coas:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- coa
example: coa
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
stage:
type: string
enum:
- Containment
- Eradication
- Identification
- Lessons Learned
- Preparation
- Recovery
- Remedy
- Response
example: Containment
description: Specifies what stage in the cyber threat management lifecycle this Course Of Action is relevant to.
coa_type:
type: string
enum:
- Diplomatic Actions
- Eradication
- Hardening
- Internal Blocking
- Logical Access Restrictions
- Monitoring
- Other
- Patching
- Perimeter Blocking
- Phase
- Physical Access Restrictions
- Playbook
- Policy Actions
- Public Disclosure
- Rebuilding
- Redirection
- Redirection (Honey Pot)
- Task
- Training
example: Diplomatic Actions
description: The type of this COA
objective:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Characterizes the objective to provide guidance on how to mitigate a security incident that has been identified.
impact:
type: string
example: string
description: Characterizes the estimated impact of applying this course of action.
cost:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Characterizes the estimated cost for applying this course of action.
efficacy:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Effectiveness of this course of action in achieving its targeted objective.
related_COAs:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
COA_id:
type: string
example: string
description: A URI leading to a COA.
required:
- COA_id
example:
confidence: High
source: string
relationship: string
COA_id: string
example:
- confidence: High
source: string
relationship: string
COA_id: string
description: Identifies or characterizes relationships to one or more related courses of action.
structured_coa_type:
type: string
enum:
- openc2
example: openc2
open_c2_coa:
type: object
properties:
type:
type: string
enum:
- structured_coa
example: structured_coa
id:
type: string
example: string
description: String with at most 1024 characters.
action:
type: object
properties:
type:
type: string
enum:
- alert
- allow
- augment
- contain
- delete
- deny
- detonate
- distill
- get
- investigate
- locate
- mitigate
- modify
- move
- notify
- other
- pause
- query
- redirect
- remediate
- report
- response
- restart
- restore
- resume
- save
- scan
- set
- snapshot
- start
- stop
- substitute
- sync
- throttle
- update
example: alert
required:
- type
example:
type: alert
target:
type: object
properties:
type:
type: string
example: acudid
specifiers:
type: string
example: string
description: Observable types that can be acted upon.
required:
- type
example:
type: acudid
specifiers: string
actuator:
type: object
properties:
type:
type: string
enum:
- endpoint
- endpoint.digital-telephone-handset
- endpoint.laptop
- endpoint.pos-terminal
- endpoint.printer
- endpoint.sensor
- endpoint.server
- endpoint.smart-meter
- endpoint.smart-phone
- endpoint.tablet
- endpoint.workstation
- network
- network.bridge
- network.firewall
- network.gateway
- network.guard
- network.hips
- network.hub
- network.ids
- network.ips
- network.modem
- network.nic
- network.proxy
- network.router
- network.security_manager
- network.sense_making
- network.sensor
- network.switch
- network.vpn
- network.wap
- other
- process
- process.aaa-server
- process.anti-virus-scanner
- process.connection-scanner
- process.directory-service
- process.dns-server
- process.email-service
- process.file-scanner
- process.location-service
- process.network-scanner
- process.remediation-service
- process.reputation-service
- process.sandbox
- process.virtualization-service
- process.vulnerability-scanner
example: endpoint
specifiers:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: List of additional properties describing the actuator.
required:
- type
example:
type: endpoint
specifiers:
- string
modifiers:
type: object
properties:
delay:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
duration:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
frequency:
type: string
example: string
description: String with at most 1024 characters.
id:
type: string
example: string
description: String with at most 1024 characters.
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
response:
type: string
enum:
- acknowledge
- command-ref
- query
- status
example: acknowledge
source:
type: string
example: string
description: String with at most 1024 characters.
destination:
type: string
enum:
- copy-to
- modify-to
- move-to
- report-to
- restore-point
- save-to
- set-to
example: copy-to
method:
type: array
items:
type: string
enum:
- acl
- authenticated
- blackhole
- blacklist
- graceful
- hibernate
- honeypot
- immediate
- segmentation
- spawn
- suspend
- unauthenticated
- whitelist
example: acl
example:
- acl
search:
type: string
enum:
- cve
- patch
- signature
- vendor_bulletin
example: cve
location:
type: string
enum:
- internal
- perimeter
example: internal
option:
type: string
example: string
description: String with at most 1024 characters.
additional_properties:
type: object
properties:
context:
type: string
example: string
description: String with at most 1024 characters.
required:
- context
example:
context: string
example:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
required:
- type
- action
example:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: Schema for submitting new COAs
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: a list of `NewCOA`s.
feedbacks:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- feedback
example: feedback
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
entity_id:
type: string
example: string
description: A URI leading to an entity.
feedback:
type: integer
enum:
- -1
- 0
- 1
example: -1
reason:
type: string
example: string
required:
- entity_id
- feedback
- reason
example:
feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new Feedback.
uniqueItems: true
example:
- feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewFeedback`s.
incidents:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- incident
example: incident
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'Represents the level of certainty or trustworthiness associated with the incident. It denotes the reliability of the intelligence associated with the incident.
The `confidence` field can take on several values, including:
- `info`: Indicates that the incident information is based on sources with no previous track record or there is no track record for the source reporting the incident.
- `low`: Indicates that the incident information is based on sources with a questionable track record or there is limited information about the accuracy of the source.
- `medium`: Indicates that the incident information is based on sources with a mixed track record or of uncertain reliability.
- `high`: Indicates that the incident information is based on sources with a proven track record and high degree of reliability.
The `confidence` field can be used to indicate the level of trust and confidence that can be attributed to the incident, and it may impact how the incident is prioritized, analyzed and addressed. It can also help in the decision-making process associated with the incident response activities.
It is important to note that the `confidence` field is subjective and can be interpreted differently by different organizations or analysts. As such, it is often used in conjunction with other intelligence attributes, such as the `severity` field, to provide a more complete picture of the incident.'
status:
type: string
enum:
- Closed
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Closed: Merged'
- 'Closed: Near-Miss'
- 'Closed: Other'
- 'Closed: Suspected'
- 'Closed: Under Review'
- Containment Achieved
- Hold
- 'Hold: External'
- 'Hold: Internal'
- 'Hold: Legal'
- Incident Reported
- New
- 'New: Presented'
- 'New: Processing'
- Open
- 'Open: Contained'
- 'Open: Investigating'
- 'Open: Recovered'
- 'Open: Reported'
- Rejected
- Restoration Achieved
- Stalled
example: Closed
description: The `status` field represents the current state of an incident within the incident management process. Its values help in tracking and reporting the progress of the incident from its discovery to its resolution.
incident_time:
type: object
properties:
opened:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first opened.
discovered:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first discovered.
reported:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first reported.
remediated:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the remediation of the damage from the incident was completed.
closed:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was last closed.
rejected:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was first rejected.
contained:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was first contained.
required:
- opened
example:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
description: Relevant time values associated with this Incident.
meta:
type: object
additionalProperties:
type: string
example: string
x-anyOf:
- type: string
example: string
- type: number
format: double
example: 10.0
- type: string
format: date-time
example: '2016-01-01T01:01:01Z'
- type: string
example: keyword
- type: boolean
example: true
example:
keyword: string
description: metadata associated to the incident.
properties: {}
scores:
type: object
additionalProperties:
type: number
format: double
example: 10.0
description: A non-negative score number.
example:
asset: 10.0
description: Used to indicate the severity or impact score of the threat represented by the incident.
properties: {}
categories:
type: array
items:
type: string
example: Attrition
example:
- Attrition
description: A set of categories for this incident.
discovery_method:
type: string
example: Agent Disclosure
description: Identifies how the incident was discovered.
intended_effect:
type: string
example: Account Takeover
description: Specifies the suspected intended effect of this incident
assignees:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: A set of owners assigned to this incident.
detection_sources:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: A set of sources that contributed threat detections to the incident.
promotion_method:
type: string
enum:
- Automated
- Manual
example: Automated
description: Describes method for promoting an Incident, whether manually or automatically. An Incident may be created manually by a SOAR analyst or SOC operator, or through an automated correlation or aggregation rule or engine that matches a specific set of events or alerts, and promotes them to Incident(s).
detection_status:
type: string
enum:
- active
- inactive_expired
- inactive_merged
- inactive_oversized
- inactive_user_closed
example: active
description: Represents the state of an incident within the incident generation process, indicating whether the incident is actively receiving updates or is no longer being updated.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
description: "Represents the potential impact of an incident on an organization's security posture and business operations. It helps organizations prioritize and allocate resources for incident response based on the severity level of the incident \nIt helps analysts and incident handlers prioritize incidents by indicating the level of risk and potential impact associated with the incident. This enables organizations to allocate resources efficiently and address the most critical incidents first.\nCan also be used to generate reports and metrics for measuring the effectiveness of the incident response process and to identify trends and patterns in the threat landscape.\nIt is important to note that the `severity` field is subjective and can be interpreted differently by different organizations or analysts. Therefore, it should be used in conjunction with other intelligence attributes, such as the `confidence` field, to provide a more comprehensive view of the incident."
tactics:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Represents the offensive techniques, approaches, or procedures that an adversary may use to achieve their objectives during an attack. It helps in understanding the intent and capabilities of the adversary and can be used to identify indicators of attack (IoAs) or indicators of compromise (IoCs) that are associated with the adversary's tactics.
techniques:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Represents the specific methods or actions used by an attacker to carry out an offensive maneuver or achieve their goals.
short_id:
type: string
example: string
description: A human-readable, short identifier for the incident, unique within an organization.
required:
- confidence
- status
- incident_time
example:
description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
description: For submitting a new Incident.
uniqueItems: true
example:
- description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
description: a list of `NewIncident`s.
indicators:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- indicator
example: indicator
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which this Indicator is considered valid.
producer:
type: string
example: string
description: String with at most 1024 characters.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
negate:
type: boolean
example: true
description: Specifies the absence of the pattern.
indicator_type:
type: array
items:
type: string
enum:
- Anonymization
- C2
- Compromised PKI Certificate
- Domain Watchlist
- Exfiltration
- File Hash Watchlist
- Host Characteristics
- IMEI Watchlist
- IMSI Watchlist
- IP Watchlist
- Login Name
- Malicious E-mail
- Malware Artifacts
- Private Threat Feed
- URL Watchlist
example: Anonymization
example:
- Anonymization
description: Specifies the type or types for this Indicator.
tags:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Descriptors for this indicator.
composite_indicator_expression:
type: object
properties:
operator:
type: string
enum:
- and
- not
- or
example: and
indicator_ids:
type: array
items:
type: string
example: string
description: A URI leading to an indicator.
example:
- string
required:
- operator
- indicator_ids
example:
operator: and
indicator_ids:
- string
likely_impact:
type: string
example: string
description: Likely potential impact within the relevant context if this Indicator were to occur.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: level of confidence held in the accuracy of this Indicator.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: Relevant kill chain phases indicated by this Indicator.
test_mechanisms:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
specification:
type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
x-anyOf:
- type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
- type: object
properties:
type:
type: string
enum:
- ThreatBrain
example: ThreatBrain
query:
type: string
example: string
variables:
type: array
items:
type: string
example: string
example:
- string
required:
- type
- variables
example:
type: ThreatBrain
query: string
variables:
- string
description: An indicator which runs in threatbrain...
- type: object
properties:
type:
type: string
enum:
- Snort
example: Snort
snort_sig:
type: string
example: string
required:
- type
- snort_sig
example:
type: Snort
snort_sig: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- SIOC
example: SIOC
SIOC:
type: string
example: string
required:
- type
- SIOC
example:
type: SIOC
SIOC: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- OpenIOC
example: OpenIOC
open_IOC:
type: string
example: string
required:
- type
- open_IOC
example:
type: OpenIOC
open_IOC: string
description: An indicator which contains an XML blob of an openIOC indicator.
required:
- producer
example:
description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: For submitting a new Indicator
uniqueItems: true
example:
- description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: a list of `NewIndicator`s.
judgements:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- judgement
example: judgement
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
disposition:
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Matches :disposition_name as in {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}
disposition_name:
type: string
enum:
- Clean
- Common
- Malicious
- Suspicious
- Unknown
example: Clean
description: String verdict identifiers.
priority:
type: integer
format: int64
example: 10
description: A value 0-100 that determine the priority of a judgement. Curated feeds of black/white lists, for example known good products within your organizations, should use a 95. All automated systems should use a priority of 90, or less. Human judgements should have a priority of 100, so that humans can always override machines.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
reason:
type: string
example: string
description: String with at most 1024 characters.
reason_uri:
type: string
example: string
description: A URI
required:
- source
- observable
- priority
- confidence
- severity
example:
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
description: Schema for submitting new Judgements.
uniqueItems: true
example:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
description: a list of `NewJudgement`s.
malwares:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- malware
example: malware
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
labels:
type: array
items:
type: string
example: adware
description: Malware label is an open vocabulary that represents different types and functions of malware. Malware labels are not mutually exclusive; a malware instance can be both spyware and a screen capture tool.
example:
- adware
description: The type of malware being described.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: The list of Kill Chain Phases for which this Malware can be used.
x_mitre_aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Software.aliases.
abstraction_level:
type: string
enum:
- family
- variant
- version
example: family
description: Malware abstraction level.
required:
- title
- description
- short_description
- labels
example:
description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new Malware.
uniqueItems: true
example:
- description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewMalware`s.
notes:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- note
example: note
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
note_class:
type: string
example: keyword
content:
type: string
example: string
description: Markdown string with at most 5000 characters.
related_entities:
type: array
items:
type: object
properties:
entity_type:
type: string
example: string
entity_id:
type: string
example: string
description: A URI leading to an entity.
required:
- entity_type
- entity_id
example:
entity_type: string
entity_id: string
example:
- entity_type: string
entity_id: string
author:
type: string
example: string
required:
- note_class
- content
- related_entities
example:
schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
description: Schema for submitting Notes
uniqueItems: true
example:
- schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
description: a list of `NewNote`s.
relationships:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- relationship
example: relationship
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
relationship_type:
type: string
example: attributed-to
source_ref:
type: string
example: string
description: A URI leading to an entity.
target_ref:
type: string
example: string
description: A URI leading to an entity.
required:
- relationship_type
- source_ref
- target_ref
example:
description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
description: Schema for submitting new Relationships.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
description: a list of `NewRelationship`s.
sightings:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- sighting
example: sighting
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
count:
type: integer
format: int64
example: 10
description: 'The number of times an indicator was observed within a certain period of time.
For example, if an IP address associated with known malicious activity is observed once within a period of time, it may indicate a low-level threat. However, if the same IP address is observed multiple times within a short time frame, it may indicate a more severe and persistent threat.
It can also be used to prioritize security alerts and indicate the urgency of a response. High counts indicate that an indicator is actively being used in a larger campaign, while low counts may indicate isolated incidents.'
internal:
type: boolean
example: false
description: "If `true`, indicates that the sighting was reported from internal sources, such as an organization's own internal security tools or SOC.\n Internal sightings are often considered more reliable and actionable than external sightings, which are reported from external sources and may have a lower level of trustworthiness. Internal sightings can provide more context and can help identify potential threats that are unique to a particular environment or organization.\n Internal sightings can also help organizations prioritize their security response efforts by identifying threats that are specific to their environment and may not yet be widely known."
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
resolution:
type: string
example: detected
description: Represents the disposition or actions taken on the associated threat intelligence.
data:
type: object
properties:
columns:
type: array
items:
type: object
properties:
name:
type: string
example: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
example: integer
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
type: boolean
example: true
description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`.
short_description:
type: string
example: string
required:
- name
- type
example:
name: string
type: integer
description: string
required: true
short_description: string
example:
- name: string
type: integer
description: string
required: true
short_description: string
description: an ordered list of column definitions
rows:
type: array
items:
type: array
items:
example: anything
example:
- - anything
description: an ordered list of rows
row_count:
type: integer
format: int64
example: 10
description: The number of rows in the data table.
required:
- columns
- rows
example:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: An embedded data table for the Sighting.
sensor:
type: string
example: endpoint
description: The OpenC2 Actuator name that best fits the device that is creating this sighting (e.g. network.firewall)
sensor_coordinates:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
os:
type: string
example: string
required:
- type
- observables
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
description: Describes the device that made the sighting (sensor) and contains identifying observables for the sensor.
targets:
type: array
items:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
os:
type: string
example: string
required:
- type
- observables
- observed_time
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
description: Describes the target of the sighting and contains identifying observables for the target.
example:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
description: 'May include one or more targets that observed the associated indicator. Targets can include network devices, host devices, or other entities that are capable of detecting indicators of compromise.
Can be used to assess the scope of potential threats, helping analysts understand which devices or components of the network may be vulnerable to attack. For example, if a particular malware strain is detected on several different systems within an organization, the `targets` field may indicate which systems are affected and which may need to be isolated or patched to prevent further spread.'
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
description: The object(s) of interest.
relations:
type: array
items:
type: object
properties:
origin:
type: string
example: string
origin_uri:
type: string
example: string
description: A URI
relation:
type: string
example: Allocated
relation_info:
type: object
additionalProperties:
example: anything
example:
keyword: anything
properties: {}
source:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
related:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
required:
- origin
- relation
- source
- related
example:
origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
description: A relation inside a Sighting.
example:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
description: Provide any context we can about where the observable came from.
context:
type: object
properties:
process_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- ProcessCreateEvent
example: ProcessCreateEvent
process_args:
type: string
example: string
description: String with at most 2048 characters.
process_hash:
type: string
example: string
description: String with at most 2048 characters.
process_size:
type: integer
format: int64
example: 10
process_disposition:
type: string
example: string
description: String with at most 1024 characters.
parent_creation_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
parent_process_id:
type: integer
format: int64
example: 10
parent_process_guid:
type: integer
format: int64
example: 10
parent_process_name:
type: string
example: string
description: String with at most 1024 characters.
parent_process_args:
type: string
example: string
description: String with at most 2048 characters.
parent_process_username:
type: string
example: string
description: String with at most 1024 characters.
parent_process_hash:
type: string
example: string
description: String with at most 2048 characters.
parent_process_size:
type: integer
format: int64
example: 10
parent_process_disposition:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- type
example:
parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
example:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
description: a list of `ProcessCreate`
library_load_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- LibraryLoadEvent
example: LibraryLoadEvent
dll_library_name:
type: string
example: string
description: String with at most 1024 characters.
dll_library_path:
type: string
example: string
description: String with at most 2048 characters.
required:
- time
- process_id
- process_name
- type
- dll_library_name
- dll_library_path
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
description: a list of `LibraryLoadType`
file_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileCreateEvent
example: FileCreateEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileCreateType`
file_delete_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileDeleteEvent
example: FileDeleteEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileDeleteType`
file_modify_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileModifyEvent
example: FileModifyEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileModifyType`
file_move_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileMoveEvent
example: FileMoveEvent
old_name:
type: string
example: string
description: String with at most 1024 characters.
new_name:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
- old_name
- new_name
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
description: a list of `FileMoveType`
netflow_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- NetflowEvent
example: NetflowEvent
traffic:
type: object
properties:
protocol:
type: integer
format: int64
example: 10
description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
source_ip:
type: string
example: string
destination_ip:
type: string
example: string
source_port:
type: integer
format: int64
example: 10
destination_port:
type: integer
format: int64
example: 10
direction:
type: string
enum:
- incoming
- outgoing
example: incoming
destination_host_name:
type: string
example: string
source_subnet:
type: string
example: string
destination_subnet:
type: string
example: string
required:
- protocol
- source_ip
- destination_ip
- source_port
- destination_port
- direction
example:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
process_path:
type: string
example: string
description: String with at most 1024 characters.
process_args:
type: string
example: string
description: String with at most 1024 characters.
process_hash:
type: string
example: string
description: String with at most 1024 characters.
process_account_type:
type: string
example: string
description: String with at most 1024 characters.
process_account:
type: string
example: string
description: String with at most 1024 characters.
parent_process_id:
type: integer
format: int64
example: 10
parent_process_name:
type: string
example: string
description: String with at most 1024 characters.
parent_process_path:
type: string
example: string
description: String with at most 1024 characters.
parent_process_args:
type: string
example: string
description: String with at most 1024 characters.
parent_process_hash:
type: string
example: string
description: String with at most 1024 characters.
parent_process_account:
type: string
example: string
description: String with at most 1024 characters.
parent_process_account_type:
type: string
example: string
description: String with at most 1024 characters.
flow_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
byte_count_out:
type: integer
format: int64
example: 10
byte_count_in:
type: integer
format: int64
example: 10
required:
- time
- process_id
- process_name
- type
- traffic
example:
parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
example:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
description: a list of `NetflowType`
http_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- HTTPEvent
example: HTTPEvent
host:
type: string
example: string
description: String with at most 1024 characters.
traffic:
type: object
properties:
protocol:
type: integer
format: int64
example: 10
description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
source_ip:
type: string
example: string
destination_ip:
type: string
example: string
source_port:
type: integer
format: int64
example: 10
destination_port:
type: integer
format: int64
example: 10
direction:
type: string
enum:
- incoming
- outgoing
example: incoming
destination_host_name:
type: string
example: string
source_subnet:
type: string
example: string
destination_subnet:
type: string
example: string
required:
- protocol
- source_ip
- destination_ip
- source_port
- destination_port
- direction
example:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
url_port:
type: integer
format: int64
example: 10
query:
type: string
example: string
description: String with at most 5000 characters.
encrypted:
type: boolean
example: true
method:
type: string
enum:
- CONNECT
- GET
- HEAD
- OPTIONS
- PATCH
- POST
- PUT
- TRACE
example: CONNECT
required:
- time
- process_id
- process_name
- type
- host
- traffic
example:
process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
example:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
description: a list of `HTTPType`
registry_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryCreateEvent
example: RegistryCreateEvent
required:
- time
- process_id
- process_name
- registry_key
- type
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
description: a list of `RegistryCreateType`
registry_set_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistrySetEvent
example: RegistrySetEvent
registry_value:
type: string
example: string
description: String with at most 2048 characters.
registry_data_length:
type: integer
format: int64
example: 10
registry_data:
type: string
example: string
description: String with at most 5000 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
- registry_value
example:
process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
example:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
description: a list of `RegistrySetType`
registry_delete_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryDeleteEvent
example: RegistryDeleteEvent
registry_value:
type: string
example: string
description: String with at most 2048 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
description: a list of `RegistryDeleteType`
registry_rename_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryRenameEvent
example: RegistryRenameEvent
registry_old_key:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
- registry_old_key
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
description: a list of `RegistryRenameType`
example:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
description: Context including the event type that best fits the type of the sighting.
activity_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the malicious activity occurred. For example, the time when a malware sample was executing, or the time range of a network intrusion.
detection_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the malicious activity was detected by the source engine or security tool. This may differ from the activity_interval if detection occurred after the activity.
modification_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the sighting record was created or last updated in the system.
required:
- observed_time
example:
description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: For submitting a new Sighting.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: a list of `NewSighting`s.
identity_assertions:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- identity-assertion
example: identity-assertion
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
identity:
type: object
properties:
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
required:
- observables
example:
observables:
- value: 1.2.3.4
type: ip
description: Attributes for which the assertion is being made.
assertions:
type: array
items:
type: object
properties:
name:
type: string
example: cisco:ctr:ad:host_domain_name
description: An open vocabulary containing well known assertion types
value:
type: string
example: string
required:
- name
- value
example:
name: cisco:ctr:ad:host_domain_name
value: string
example:
- name: cisco:ctr:ad:host_domain_name
value: string
description: Any known context about the identity attributes.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- identity
- assertions
example:
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
description: For submitting a new IdentityAssertion.
uniqueItems: true
example:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
description: a list of `NewIdentityAssertion`s.
target_records:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- target-record
example: target-record
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
targets:
type: array
items:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
os:
type: string
example: string
description: Source Operating System where TargetRecord was originated.
internal:
type: boolean
example: false
description: Is it internal to our network?
sensor:
type: string
example: string
description: 'The OpenC2 Actuator name that best fits the device that is creating this TargetRecord (e.g.: network.firewall, etc.)'
source_uri:
type: string
example: string
description: A URI
required:
- type
- observables
- observed_time
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
description: Schema for TargetRecord Targets
example:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
required:
- source
- targets
example:
description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new TargetRecord.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewTargetRecord`s.
tools:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- tool
example: tool
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
labels:
type: array
items:
type: string
example: credential-exploitation
description: Tool labels describe the categories of tools that can be used to perform attacks.
example:
- credential-exploitation
description: The kind(s) of tool(s) being described.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: The list of kill chain phases for which this Tool can be used.
tool_version:
type: string
example: string
description: The version identifier associated with the Tool.
x_mitre_aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Software.aliases.
required:
- title
- description
- short_description
- labels
example:
description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new Tool.
uniqueItems: true
example:
- description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewTool`s.
verdicts:
type: array
items:
type: object
properties:
type:
type: string
enum:
- verdict
example: verdict
disposition:
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Numeric verdict identifiers.
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
disposition_name:
type: string
enum:
- Clean
- Common
- Malicious
- Suspicious
- Unknown
example: Clean
description: 'The disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}'
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- type
- disposition
- observable
- valid_time
example:
type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: "A Verdict is chosen from all of the Judgements on that Observable which have not yet expired. The highest priority Judgement becomes the active verdict. If there is more than one Judgement with that priority, then Clean disposition has priority over all others, then Malicious disposition, and so on down to Unknown.\n\n The ID of a verdict is a a str of the form \"observable.type:observable.value\" for example, \"ip:1.1.1.1\""
uniqueItems: true
example:
- type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: a list of `Verdict`s.
data_tables:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- data-table
example: data-table
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
columns:
type: array
items:
type: object
properties:
name:
type: string
example: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
example: integer
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
type: boolean
example: true
description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`.
short_description:
type: string
example: string
required:
- name
- type
example:
name: string
type: integer
description: string
required: true
short_description: string
example:
- name: string
type: integer
description: string
required: true
short_description: string
description: An ordered list of column definitions.
rows:
type: array
items:
type: array
items:
example: anything
example:
- - anything
description: An ordered list of rows
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
row_count:
type: integer
format: int64
example: 10
description: The number of rows in the data table.
required:
- columns
- rows
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting a NewDataTable record.
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewDataTable`s.
weaknesses:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- weakness
example: weakness
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: Should be short and limited to the key points that define this weakness.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
structure:
type: string
enum:
- Chain
- Composite
- Simple
example: Chain
description: Defines the structural nature of the weakness.
languages:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Language name (Clojure, Java, ...)
class:
type: string
example: Assembly
description: Class of language.
required:
- prevalence
example:
prevalence: Often
name: string
class: Assembly
example:
- prevalence: Often
name: string
class: Assembly
description: Applicable Languages.
operating_systems:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: String with at most 1024 characters.
version:
type: string
example: string
description: String with at most 1024 characters.
cpe_id:
type: string
example: string
description: String with at most 1024 characters.
class:
type: string
example: Android
description: Class of Operating System.
required:
- prevalence
example:
prevalence: Often
name: string
version: string
cpe_id: string
class: Android
example:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
description: Applicable operating systems.
architectures:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Architecture name (ARM, x86, ...)
class:
type: string
example: Embedded
description: Class of architecture
required:
- prevalence
example:
prevalence: Often
name: string
class: Embedded
example:
- prevalence: Often
name: string
class: Embedded
description: Applicable architectures.
paradigms:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Paradigm name (Client Server, Mainframe)
required:
- prevalence
example:
prevalence: Often
name: string
example:
- prevalence: Often
name: string
description: Applicable paradigms.
technologies:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Technology name (Web Server, Web Client)
required:
- prevalence
example:
prevalence: Often
name: string
example:
- prevalence: Often
name: string
description: Applicable technologies.
background_details:
type: string
example: string
description: Information that is relevant but not related to the nature of the weakness itself.
alternate_terms:
type: array
items:
type: object
properties:
term:
type: string
example: string
description: The actual alternate term.
description:
type: string
example: string
description: Provides context for the alternate term by which this weakness may be known.
required:
- term
example:
term: string
description: string
example:
- term: string
description: string
description: Indicates one or more other names used to describe this weakness.
modes_of_introduction:
type: array
items:
type: object
properties:
phase:
type: string
example: Architecture and Design
description: Identifies the point in the software life cycle at which the weakness may be introduced.
note:
type: string
example: string
description: Provides a typical scenario related to introduction during the given phase.
required:
- phase
example:
phase: Architecture and Design
note: string
example:
- phase: Architecture and Design
note: string
description: Information about how and when a given weakness may be introduced.
likelihood:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Likelihood of exploit.
common_consequences:
type: array
items:
type: object
properties:
scopes:
type: array
items:
type: string
example: Access Control
description: Defines the different areas of software security that can be affected by exploiting a weakness.
example:
- Access Control
description: Identifies the security property that is violated.
impacts:
type: array
items:
type: string
example: Alter Execution Logic
example:
- Alter Execution Logic
description: Describes the technical impact that arises if an adversary succeeds in exploiting this weakness.
likelihood:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: How likely the specific consequence is expected to be seen relative to the other consequences.
note:
type: string
example: string
description: Additional commentary about a consequence.
required:
- scopes
example:
scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
example:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
description: Refers to the typical or expected negative effects that can result from exploiting the weakness. This could include anything from unauthorized access to data, denial of service, system crashes or other things.
detection_methods:
type: array
items:
type: object
properties:
method:
type: string
example: Architecture or Design Review
description: Identifies the particular detection method being described.
description:
type: string
example: string
description: Provides some context of how this method can be applied to a specific weakness.
effectiveness:
type: string
example: High
description: How effective the detection method may be in detecting the associated weakness.
effectiveness_notes:
type: string
example: string
description: Provides additional discussion of the strengths and shortcomings of this detection method.
required:
- method
- description
example:
method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
example:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
description: Identifies methods that may be employed to detect this weakness, including their strengths and limitations.
potential_mitigations:
type: array
items:
type: object
properties:
description:
type: string
example: string
description: A description of this individual mitigation including any strengths and shortcomings of this mitigation for the weakness.
phases:
type: array
items:
type: string
example: Architecture and Design
description: Defines the different regularities that guide the applicability of platforms.
example:
- Architecture and Design
description: Indicates the development life cycle phase during which this particular mitigation may be applied.
strategy:
type: string
example: Attack Surface Reduction
description: A general strategy for protecting a system to which this mitigation contributes.
effectiveness:
type: string
example: Defense in Depth
description: Summarizes how effective the mitigation may be in preventing the weakness.
effectiveness_notes:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
- description
example:
description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
example:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
description: Describes potential mitigations associated with a weakness.
functional_areas:
type: array
items:
type: string
example: Authentication
description: Defines the different functional areas of software in which the weakness may appear.
example:
- Authentication
description: Identifies the functional area of the software in which the weakness is most likely to occur.
affected_resources:
type: array
items:
type: string
example: CPU
description: Defines a resource of a system.
example:
- CPU
description: Identifies system resources that can be affected by an exploit of this weakness.
notes:
type: array
items:
type: object
properties:
type:
type: string
example: Applicable Platform
description: Defines the different types of notes that can be associated with a weakness.
note:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
- type
- note
example:
type: Applicable Platform
note: string
example:
- type: Applicable Platform
note: string
description: Provides any additional comments about the weakness.
abstraction_level:
type: string
enum:
- Base
- Class
- Compound
- Variant
example: Base
description: Refers to the level of abstraction or granularity used to describe the weakness. It helps to categorize the vulnerability based on the level of detail provided.
required:
- description
example:
description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
description: For submitting a new weakness.
uniqueItems: true
example:
- description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
description: a list of `NewWeakness`s.
vulnerabilities:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- vulnerability
example: vulnerability
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: "Various sources of vulnerability information can be used, including third-party resources like the National Vulnerability Database (NVD) and the Common Vulnerabilities and Exposures (CVE) database. The platform then analyzes this data and provides the user with relevant details such as the severity of the vulnerability, the affected systems, and remediation recommendations. \n\n Based on this information, the user can prioritize patching and other mitigation strategies to reduce the risk of potential attacks."
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
cve:
type: object
properties:
cve_data_meta:
type: object
properties:
id:
type: string
example: string
description: String with at most 1024 characters.
assigner:
type: string
example: string
description: String with at most 1024 characters.
example:
id: string
assigner: string
required:
- cve_data_meta
example:
cve_data_meta:
id: string
assigner: string
impact:
type: object
properties:
cvss_v2:
type: object
properties:
vector_string:
type: string
example: string
description: a text representation of a set of CVSSv2 metrics. It is commonly used to record or transfer CVSSv2 metric information in a concise form
base_score:
type: number
format: double
example: 10.0
description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v2/guide'
base_severity:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
impact_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
exploitability_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
access_vector:
type: string
enum:
- adjacent network
- local
- network
example: network
description: This metric reflects how the vulnerability is exploited.The more remote an attacker can be to attack a host, the greater the vulnerability score.
access_complexity:
type: string
enum:
- high
- low
- medium
example: low
description: 'This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system. For example, consider a buffer overflow in an Internet service: once the target system is located, the attacker can launch an exploit at will.'
authentication:
type: string
enum:
- multiple
- none
- single
example: none
description: This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. This metric does not gauge the strength or complexity of the authentication process, only that an attacker is required to provide credentials before an exploit may occur. The fewer authentication instances that are required, the higher the vulnerability score.
confidentiality_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact on confidentiality of a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. Increasedconfidentiality impact increases the vulnerability score.
integrity_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information. Increased integrity impact increases the vulnerability score.
availability_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact to availability of a successfully exploited vulnerability. Availability refers to the accessibility of information resources. Attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system. Increased availability impact increases the vulnerability score.
exploitability:
type: string
enum:
- functional
- high
- not_defined
- proof_of_concept
- unproven
example: not_defined
description: This metric measures the current state of exploit techniques or code availability. Public availability of easy-to-use exploit code increases the number of potential attackers by including those who are unskilled thereby increasing the severity of the vulnerability.
remediation_level:
type: string
enum:
- not_defined
- official_fix
- temporary_fix
- unavailable
- workaround
example: not_defined
description: The remediation level of a vulnerability is an important factor for prioritization. The typical vulnerability is unpatched when initially published. Workarounds or hotfixes may offer interim remediation until an official patch or upgrade is issued. Each of these respective stages adjusts the temporal score downwards, reflecting the decreasing urgency as remediation becomes final. The less official and permanent a fix, the higher the vulnerability score is.
report_confidence:
type: string
enum:
- confirmed
- not_defined
- unconfirmed
- uncorroborated
example: not_defined
description: This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details. Sometimes, only the existence of vulnerabilities are publicized, but without specific details. The vulnerability may later be corroborated and then confirmed through acknowledgement by the author or vendor of the affected technology. The urgency of a vulnerability is higher when a vulnerability is known to exist with certainty. This metric also suggests the level of technical knowledge available to would-be attackers. The more a vulnerability is validated by the vendor or other reputable sources, the higher the score.
temporal_vector_string:
type: string
example: string
description: A text representation of a set of CVSSv2 temporal metrics. Temporal metrics allow analysists to calculate threat severity based on temporal factors such as reliability of vulnerability reports, availability of mitigations, and the ease or difficulty of conducting the exploit. It is commonly used to record or transfer CVSSv2 metric information in a concise form
collateral_damage_potential:
type: string
enum:
- high
- low
- low_medium
- medium_high
- none
- not_defined
example: not_defined
description: This metric measures the potential for loss of life or physical assets through damage or theft of property or equipment. The metric may also measure economic loss of productivity or revenue. Naturally, the greater the damage potential, the higher the vulnerability score.
target_distribution:
type: string
enum:
- high
- low
- medium
- none
- not_defined
example: not_defined
description: This metric measures the proportion of vulnerable systems. It is meant as an environment-specific indicator in order to approximate the percentage of systems that could be affected by the vulnerability. The greater the proportion of vulnerable systems, the higher the score.
confidentiality_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
integrity_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
availability_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
environmental_vector_string:
type: string
example: string
description: A text representation of a set of CVSSv2 environmental metrics. Environmental metrics allow analysists to calculate threat scores in relation to environmental security requirements, collateral damage potential, and target availability. It is commonly used to record or transfer CVSSv2 metric information in a concise form
obtain_all_privilege:
type: boolean
example: true
obtain_user_privilege:
type: boolean
example: true
obtain_other_privilege:
type: boolean
example: true
user_interaction_required:
type: boolean
example: true
required:
- vector_string
- base_score
- base_severity
example:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
type: object
properties:
vector_string:
type: string
example: string
description: a text representation of a set of CVSSv3 metrics. It is commonly used to record or transfer CVSSv3 metric information in a concise form
base_score:
type: number
format: double
example: 10.0
description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v3-1'
base_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
impact_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
exploitability_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
attack_vector:
type: string
enum:
- adjacent_network
- local
- network
- physical
example: adjacent_network
description: Reflects the context by which vulnerability exploitation is possible
modified_attack_vector:
type: string
enum:
- adjacent_network
- local
- network
- not_defined
- physical
example: not_defined
description: modified attack vector
attack_complexity:
type: string
enum:
- high
- low
example: high
description: describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability
modified_attack_complexity:
type: string
enum:
- high
- low
- not_defined
example: not_defined
description: modified attack complexity
privileges_required:
type: string
enum:
- high
- low
- none
example: high
description: describes the level of privileges an attacker must possess before successfully exploiting the vulnerability
modified_privileges_required:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified privileges required
user_interaction:
type: string
enum:
- none
- required
example: none
description: captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component
modified_user_interaction:
type: string
enum:
- none
- not_defined
- required
example: none
description: modified user interaction
scope:
type: string
enum:
- changed
- unchanged
example: changed
description: the ability for a vulnerability in one software component to impact resources beyond its means, or privileges
modified_scope:
type: string
enum:
- changed
- not_defined
- unchanged
example: not_defined
description: modified scope
confidentiality_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability
modified_confidentiality_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified confidentiality impact
integrity_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to integrity of a successfully exploited vulnerability
modified_integrity_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified integrity impact
availability_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability
modified_availability_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified availability impact
exploit_code_maturity:
type: string
enum:
- functional
- high
- not_defined
- proof_of_concept
- unproven
example: functional
description: measures the likelihood of the vulnerability being attacked
remediation_level:
type: string
enum:
- high
- not_defined
- offical_fix
- temporary_fix
- unavailable
- workaround
example: high
description: Remediation Level of a vulnerability is an important factor for prioritization
report_confidence:
type: string
enum:
- confirmed
- reasonable
- unknown
example: confirmed
description: measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details
temporal_score:
type: number
format: double
example: 10.0
description: Round up(CVSSv3BaseScore × CVSSv3ExploitCodeMaturity × CVSSv3RemediationLevel × CVSSv3ReportConfidence)
temporal_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
description: temporal severity
availability_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
confidentiality_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
integrity_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
environmental_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
environmental_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
required:
- vector_string
- base_score
- base_severity
example:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
example:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: "Describes the potential impact of a vulnerability that is being tracked in the system. Provides information on the extent of damage that a vulnerability can cause and how serious the consequences could be if it is exploited. \n\nMay contain granular information about the vulnerability severity using the CVSS system, versions 2 and 3.\n\nCVSSv2 and CVSSv3 have different methods of calculating base scores, but both are designed to provide an indication of the level of risk that a vulnerability poses. The base score ranges from 0 to 10, with 10 being the most severe. Additionally, both CVSSv2 and CVSSv3 define severity levels, such as low, medium, high, and critical, based on the base score."
configurations:
type: object
properties:
CVE_data_version:
type: string
example: string
description: Specifies the version of the CVE (Common Vulnerabilities and Exposures) dictionary used by the vulnerability information provider.
nodes:
type: array
items:
type: object
properties:
operator:
type: string
enum:
- AND
- OR
example: AND
description: The operator string influences how seqs of cpe matches are related to one another.
cpe_match:
type: array
items:
type: object
properties:
vulnerable:
type: boolean
example: true
cpe23Uri:
type: string
example: string
description: A text representation of a software or hardware platform.
versionStartIncluding:
type: string
example: string
description: A string representing the lower bound(inclusive) of version in the CPE.
versionEndIncluding:
type: string
example: string
description: A string representing the upper bound(inclusive) of version in the CPE.
versionStartExcluding:
type: string
example: string
description: A string representing the lower bound(exclusive) of version in the CPE.
versionEndExcluding:
type: string
example: string
description: A string representing the upper bound(exclusive) of version in the CPE.
required:
- vulnerable
- cpe23Uri
example:
vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
example:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
type: array
items:
type: object
properties:
operator:
type: string
enum:
- AND
- OR
example: AND
description: The operator string influences how seqs of cpe matches are related to one another.
cpe_match:
type: array
items:
type: object
properties:
vulnerable:
type: boolean
example: true
cpe23Uri:
type: string
example: string
description: A text representation of a software or hardware platform.
versionStartIncluding:
type: string
example: string
description: A string representing the lower bound(inclusive) of version in the CPE.
versionEndIncluding:
type: string
example: string
description: A string representing the upper bound(inclusive) of version in the CPE.
versionStartExcluding:
type: string
example: string
description: A string representing the lower bound(exclusive) of version in the CPE.
versionEndExcluding:
type: string
example: string
description: A string representing the upper bound(exclusive) of version in the CPE.
required:
- vulnerable
- cpe23Uri
example:
vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
example:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate:
type: boolean
example: true
description: Negates operator when true.
required:
- operator
- cpe_match
example:
operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
example:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate:
type: boolean
example: true
description: Negates operator when true.
required:
- operator
example:
operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
example:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
description: Each `node` in the CTIM standard configuration includes information such as the `operator` (such as "less than", or "greater than or equal to"), and the `cpe` (Common Platform Enumeration) string which identifies the specific software, `CPE` is a structured naming scheme for IT systems, platforms, and software packages, and it is instrumental in enabling data exchange between different systems.
required:
- CVE_data_version
- nodes
example:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
description: "Represents a list of affected versions or configurations of a software component that is impacted by a vulnerability. \nBy tracking the affected software components and versions, defenders can identify which systems are potentially exposed to an attack, and apply appropriate mitigations."
published_date:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: "Represents the date when a vulnerability was publicly disclosed or made available to the general public. \n\nImportant for tracking the age of a vulnerability, as well as for determining when a particular vulnerability was first introduced into a system. The published date can be used to identify the time window during which a system may have been vulnerable to a particular exploit.\n\nFor example, if an organization discovers that a vulnerability was published before their system's installation date, but they did not apply the necessary security updates in a timely manner, it can be concluded that their system was vulnerable for the period between the installation date and the date when the necessary security updates were applied."
last_modified_date:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: 'Represents the date when the vulnerability metadata was last updated in the internal database.
It can be used to track the freshness of the vulnerability information. If the `last_modified_date` is more recent than the `published_date`, it can indicate that there has been some new information or updates related to the vulnerability, such as new patch releases or changes in the severity or impact rating.'
required:
- description
example:
description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: For submitting a new vulnerability.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: a list of `NewVulnerability`s.
actor_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_mapping_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_properties_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
attack_pattern_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
campaign_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
coa_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
feedback_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
identity_assertion_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
incident_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
indicator_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
judgement_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
malware_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
note_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
relationship_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
sighting_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
target_record_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
tool_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
verdict_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
data_table_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
weakness_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
vulnerability_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- source
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
asset_mapping_refs:
- string
note_refs:
- string
data_table_refs:
- string
attack_pattern_refs:
- string
sighting_refs:
- string
schema_version: 1.3.30
revision: 10
assets:
- description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
weakness_refs:
- string
tool_refs:
- string
target_record_refs:
- string
asset_refs:
- string
tools:
- description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
indicators:
- description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
attack_patterns:
- description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
type: bundle
weaknesses:
- description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
source: string
external_ids:
- string
feedback_refs:
- string
asset_properties:
- properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
short_description: string
feedbacks:
- feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
judgement_refs:
- string
title: string
coa_refs:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
verdicts:
- type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
campaigns:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
source_uri: string
actors:
- description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
indicator_refs:
- string
actor_refs:
- string
language: string
data_tables:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
id: string
notes:
- schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
identity_assertions:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
judgements:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
malwares:
- description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
target_records:
- description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
asset_mappings:
- asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
relationship_refs:
- string
tlp: green
incidents:
- description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
identity_assertion_refs:
- string
sightings:
- description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
campaign_refs:
- string
vulnerability_refs:
- string
asset_properties_refs:
- string
relationships:
- description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
timestamp: '2016-01-01T01:01:01Z'
verdict_refs:
- string
malware_refs:
- string
incident_refs:
- string
vulnerabilities:
- description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
coas:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: Describes a Bundle of any set of CTIM entities.
investigated_observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
source:
title: InvestigationSource
description: String with at most 1024 characters.
type: string
example: Cisco XDR Automated Question
title:
title: InvestigationTitle
description: String with at most 1024 characters.
type: string
example: Which devices in my org was this sha seen on?
description:
title: InvestigationDescription
description: String with at most 5000 characters.
type: string
example: 'For the following hashes:
- sha256:defg...1234
- sha256:abcd..1234
Determine which devices in my org have instances of the file in the past 30 days'
required:
- bundle
application/transit+json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- bundle
example: bundle
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
actors:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- actor
example: actor
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Indicates the time span for which the information about the Actor is relevant, and after which it could become outdated.
actor_types:
type: array
items:
type: string
example: Cyber Espionage Operations
example:
- Cyber Espionage Operations
identity:
type: object
properties:
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
related_identities:
type: array
items:
type: object
properties:
identity:
type: string
example: string
description: The reference (URI) of the related Identity object.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Specifies the level of confidence in the assertion of the relationship between the two objects.
information_source:
type: string
example: string
description: Specifies the source of the information about the relationship between the two components.
relationship:
type: string
example: string
required:
- identity
example:
identity: string
confidence: High
information_source: string
relationship: string
description: Describes a related Identity
example:
- identity: string
confidence: High
information_source: string
relationship: string
description: Identifies other entity Identities related to this Identity.
required:
- description
- related_identities
example:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
description: Can contain information such as the name of the attacker, the group or organization they belong to, or any other identifier that can help in the attribution process.
motivation:
type: string
example: Ego
description: The reason or purpose behind the malicious activity attributed to this Actor. By understanding a threat actor's motivation, analysts can better predict the attacker's behavior and anticipate future malicious actions.
sophistication:
type: string
enum:
- Aspirant
- Expert
- Innovator
- Novice
- Practitioner
example: Aspirant
description: "Represents the level of expertise and skill that the threat actor has displayed in their malicious activities. Can help security analysts assess the potential impact of an attacker's TTPs and determine the potential attack surface. \n\nFor example, a threat actor with a low sophistication level may primarily rely on off-the-shelf malware and attack tools, while an attacker with high sophistication may use custom tools with advanced evasion techniques, zero-day exploits, and sophisticated methods for command and control of their malware. \n\nThe sophistication level of an attacker can also be inferred based on several factors such as the complexity of attacks, the attacker's knowledge of the targeted organization's systems, and the attacker's ability to remain undetected.\n\nIf an attacker shows a high level of sophistication in reconnaissances, social engineering, and phishing, then the attacker may have a good knowledge of the targeted organization and its employees. This means that the attacker may be more successful in infiltrating the organization's network and compromising its systems."
intended_effect:
type: string
example: Account Takeover
description: "Represents the desired outcome or impact the threat actor is trying to achieve through their malicious activities. \n\n Helps security analysts to understand the attacker's goals beyond the immediate impact of the attack. By understanding the intended effect, analysts can draw connections between seemingly unrelated attacks and build a more complete understanding of an attacker's long-term goals and motivations."
planning_and_operational_support:
type: string
example: string
description: "Provides information about the resources and capabilities of the attacker that could be used to assist in planning and operations related to the threat.\n\n It can be used to describe Infrastructure, Tools, Techniques, and Capabilities used by the threat actor."
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'This field can help analysts decide how much trust they can put in the information provided by the threat intelligence sources.
For example, an Actor entity can have high confidence if the organization''s security researchers have been tracking it for a long time and have gathered a significant amount of intelligence about it through various sources, such as analysis of malware, network traffic, and human intelligence. In contrast, low confidence may indicate the organization has only seen limited or circumstantial evidence.'
aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: A list of other names that this Threat Actor is believed to use.
required:
- source
- title
- description
- short_description
example:
description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
description: Schema for submitting new Actors
uniqueItems: true
example:
- description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
description: a list of `NewActor`s.
assets:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset
example: asset
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: 'Specifies the time range during which the asset is considered valid or accurate.
For example, if an asset entity represents a device, the `valid_time` field could be used to indicate the period during which the device''s configuration information is deemed accurate.'
asset_type:
type: string
enum:
- application
- data
- device
- network
- person
example: application
description: 'Type of the Asset: Device, Person, Application, etc.'
required:
- source
- valid_time
- asset_type
example:
description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new Assets
uniqueItems: true
example:
- description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAsset`s.
asset_mappings:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset-mapping
example: asset-mapping
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: For each asset, we allow for the assertion of time bound properties.This gives us both a record of the current state of the asset,as well as history.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'Level of confidence held in the characterization of this AssetMapping e.g.: is it susceptible to manipulation or translation?'
specificity:
type: string
enum:
- Low
- Medium
- Unique
example: Low
description: Denotes the level of how many assets potentially could have this same identifier.
stability:
type: string
enum:
- Managed
- Physical
- Temporary
example: Managed
description: Do we manage when it changes, or is it always a time bound assignment?
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: An AssetMapping is a record that a specific Observable maps to an Asset for an indicated period of time.
asset_ref:
type: string
example: string
description: URI that points to the mapped Asset.
asset_type:
type: string
enum:
- application
- data
- device
- network
- person
example: application
description: 'Type of the mapped Asset: Device, Person, Application, etc.'
required:
- source
- valid_time
- confidence
- specificity
- stability
- observable
- asset_ref
- asset_type
example:
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
description: Schema for submitting new AssetMapping.
uniqueItems: true
example:
- asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
description: a list of `NewAssetMapping`s.
asset_properties:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset-properties
example: asset-properties
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which the AssetProperties is considered valid.
asset_ref:
type: string
example: string
description: URI that points to the associated Asset.
properties:
type: array
items:
type: object
properties:
name:
type: string
example: string
description: The properties are an open vocabulary.
value:
type: string
example: string
required:
- name
- value
example:
name: string
value: string
example:
- name: string
value: string
required:
- source
- valid_time
- asset_ref
example:
properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new AssetProperties
uniqueItems: true
example:
- properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAssetProperties`s.
attack_patterns:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- attack-pattern
example: attack-pattern
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: A kill chain is a series of steps that an attacker must go through to successfully achieve their objective. The concept was originally developed by the military, but has been adapted to the cybersecurity field to describe the steps an attacker goes through to compromise a target system and achieve their goal.
x_mitre_data_sources:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Data Sources.
x_mitre_platforms:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Platforms.
x_mitre_contributors:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Contributors.
abstraction_level:
type: string
enum:
- aggregate
- category
- detailed
- meta
- standard
example: aggregate
description: The CAPEC abstraction level for patterns describing techniques to attack a system.
required:
- title
- description
- short_description
example:
description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new AttackPattern
uniqueItems: true
example:
- description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAttackPattern`s.
campaigns:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- campaign
example: campaign
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Timestamp for the definition of a specific version of a campaign.
campaign_type:
type: string
example: string
description: 'String value that describes the type of campaign. For example, a campaign type could be ''Ransomware'', ''Advanced Persistent Threat'', ''Business Email Compromise'', ''Phishing'', etc. '
names:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Used to capture alternate names or aliases associated with the campaign. A cyberattack campaign may have multiple names or aliases depending on the group or actor(s) behind the attack, e.g., 'Wannacry' is also known as 'WannaCrypt', 'WCry', 'Wanna Decryptor', etc.
intended_effect:
type: array
items:
type: string
example: Account Takeover
example:
- Account Takeover
description: Characterizes the intended effect of this cyber threat campaign.
status:
type: string
enum:
- Future
- Historic
- Ongoing
example: Future
description: "Indicates current Status of the Campaign. \n\nCan have one of the following values: \n\n- Ongoing: Indicates that the campaign is currently active and ongoing. For example, a mass phishing campaign that is actively targeting users is considered 'ongoing'.\n\n- Historic: Campaign has already occurred and is now in the past.\n\n- Future: This indicates that a campaign is planned or expected to occur in the future. For example, a threat actor may announce their intention to launch a specific cyberattack campaign at a future date."
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Level of confidence held in the characterization of this Campaign.
activity:
type: array
items:
type: object
properties:
date_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Specifies the date and time at which the activity occured.
description:
type: string
example: string
description: A description of the activity.
required:
- date_time
- description
example:
date_time: '2016-01-01T01:01:01Z'
description: string
description: Captures the specific activities or tactics associated with the entity. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc.
example:
- date_time: '2016-01-01T01:01:01Z'
description: string
description: 'Used to capture specific activities or tactics associated with the campaign.
The ''activity'' field is an array of objects, and each element represents a specific activity and time associated with the campaign. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc. By capturing these activities analysts can identify the specific tactics used by the threat actor(s) behind the campaign.'
required:
- title
- description
- short_description
- campaign_type
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
description: Schema for submitting new Campaigns
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
description: a list of `NewCampaign`s.
coas:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- coa
example: coa
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
stage:
type: string
enum:
- Containment
- Eradication
- Identification
- Lessons Learned
- Preparation
- Recovery
- Remedy
- Response
example: Containment
description: Specifies what stage in the cyber threat management lifecycle this Course Of Action is relevant to.
coa_type:
type: string
enum:
- Diplomatic Actions
- Eradication
- Hardening
- Internal Blocking
- Logical Access Restrictions
- Monitoring
- Other
- Patching
- Perimeter Blocking
- Phase
- Physical Access Restrictions
- Playbook
- Policy Actions
- Public Disclosure
- Rebuilding
- Redirection
- Redirection (Honey Pot)
- Task
- Training
example: Diplomatic Actions
description: The type of this COA
objective:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Characterizes the objective to provide guidance on how to mitigate a security incident that has been identified.
impact:
type: string
example: string
description: Characterizes the estimated impact of applying this course of action.
cost:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Characterizes the estimated cost for applying this course of action.
efficacy:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Effectiveness of this course of action in achieving its targeted objective.
related_COAs:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
COA_id:
type: string
example: string
description: A URI leading to a COA.
required:
- COA_id
example:
confidence: High
source: string
relationship: string
COA_id: string
example:
- confidence: High
source: string
relationship: string
COA_id: string
description: Identifies or characterizes relationships to one or more related courses of action.
structured_coa_type:
type: string
enum:
- openc2
example: openc2
open_c2_coa:
type: object
properties:
type:
type: string
enum:
- structured_coa
example: structured_coa
id:
type: string
example: string
description: String with at most 1024 characters.
action:
type: object
properties:
type:
type: string
enum:
- alert
- allow
- augment
- contain
- delete
- deny
- detonate
- distill
- get
- investigate
- locate
- mitigate
- modify
- move
- notify
- other
- pause
- query
- redirect
- remediate
- report
- response
- restart
- restore
- resume
- save
- scan
- set
- snapshot
- start
- stop
- substitute
- sync
- throttle
- update
example: alert
required:
- type
example:
type: alert
target:
type: object
properties:
type:
type: string
example: acudid
specifiers:
type: string
example: string
description: Observable types that can be acted upon.
required:
- type
example:
type: acudid
specifiers: string
actuator:
type: object
properties:
type:
type: string
enum:
- endpoint
- endpoint.digital-telephone-handset
- endpoint.laptop
- endpoint.pos-terminal
- endpoint.printer
- endpoint.sensor
- endpoint.server
- endpoint.smart-meter
- endpoint.smart-phone
- endpoint.tablet
- endpoint.workstation
- network
- network.bridge
- network.firewall
- network.gateway
- network.guard
- network.hips
- network.hub
- network.ids
- network.ips
- network.modem
- network.nic
- network.proxy
- network.router
- network.security_manager
- network.sense_making
- network.sensor
- network.switch
- network.vpn
- network.wap
- other
- process
- process.aaa-server
- process.anti-virus-scanner
- process.connection-scanner
- process.directory-service
- process.dns-server
- process.email-service
- process.file-scanner
- process.location-service
- process.network-scanner
- process.remediation-service
- process.reputation-service
- process.sandbox
- process.virtualization-service
- process.vulnerability-scanner
example: endpoint
specifiers:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: List of additional properties describing the actuator.
required:
- type
example:
type: endpoint
specifiers:
- string
modifiers:
type: object
properties:
delay:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
duration:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
frequency:
type: string
example: string
description: String with at most 1024 characters.
id:
type: string
example: string
description: String with at most 1024 characters.
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
response:
type: string
enum:
- acknowledge
- command-ref
- query
- status
example: acknowledge
source:
type: string
example: string
description: String with at most 1024 characters.
destination:
type: string
enum:
- copy-to
- modify-to
- move-to
- report-to
- restore-point
- save-to
- set-to
example: copy-to
method:
type: array
items:
type: string
enum:
- acl
- authenticated
- blackhole
- blacklist
- graceful
- hibernate
- honeypot
- immediate
- segmentation
- spawn
- suspend
- unauthenticated
- whitelist
example: acl
example:
- acl
search:
type: string
enum:
- cve
- patch
- signature
- vendor_bulletin
example: cve
location:
type: string
enum:
- internal
- perimeter
example: internal
option:
type: string
example: string
description: String with at most 1024 characters.
additional_properties:
type: object
properties:
context:
type: string
example: string
description: String with at most 1024 characters.
required:
- context
example:
context: string
example:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
required:
- type
- action
example:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: Schema for submitting new COAs
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: a list of `NewCOA`s.
feedbacks:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- feedback
example: feedback
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
entity_id:
type: string
example: string
description: A URI leading to an entity.
feedback:
type: integer
enum:
- -1
- 0
- 1
example: -1
reason:
type: string
example: string
required:
- entity_id
- feedback
- reason
example:
feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new Feedback.
uniqueItems: true
example:
- feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewFeedback`s.
incidents:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- incident
example: incident
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'Represents the level of certainty or trustworthiness associated with the incident. It denotes the reliability of the intelligence associated with the incident.
The `confidence` field can take on several values, including:
- `info`: Indicates that the incident information is based on sources with no previous track record or there is no track record for the source reporting the incident.
- `low`: Indicates that the incident information is based on sources with a questionable track record or there is limited information about the accuracy of the source.
- `medium`: Indicates that the incident information is based on sources with a mixed track record or of uncertain reliability.
- `high`: Indicates that the incident information is based on sources with a proven track record and high degree of reliability.
The `confidence` field can be used to indicate the level of trust and confidence that can be attributed to the incident, and it may impact how the incident is prioritized, analyzed and addressed. It can also help in the decision-making process associated with the incident response activities.
It is important to note that the `confidence` field is subjective and can be interpreted differently by different organizations or analysts. As such, it is often used in conjunction with other intelligence attributes, such as the `severity` field, to provide a more complete picture of the incident.'
status:
type: string
enum:
- Closed
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Closed: Merged'
- 'Closed: Near-Miss'
- 'Closed: Other'
- 'Closed: Suspected'
- 'Closed: Under Review'
- Containment Achieved
- Hold
- 'Hold: External'
- 'Hold: Internal'
- 'Hold: Legal'
- Incident Reported
- New
- 'New: Presented'
- 'New: Processing'
- Open
- 'Open: Contained'
- 'Open: Investigating'
- 'Open: Recovered'
- 'Open: Reported'
- Rejected
- Restoration Achieved
- Stalled
example: Closed
description: The `status` field represents the current state of an incident within the incident management process. Its values help in tracking and reporting the progress of the incident from its discovery to its resolution.
incident_time:
type: object
properties:
opened:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first opened.
discovered:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first discovered.
reported:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first reported.
remediated:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the remediation of the damage from the incident was completed.
closed:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was last closed.
rejected:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was first rejected.
contained:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was first contained.
required:
- opened
example:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
description: Relevant time values associated with this Incident.
meta:
type: object
additionalProperties:
type: string
example: string
x-anyOf:
- type: string
example: string
- type: number
format: double
example: 10.0
- type: string
format: date-time
example: '2016-01-01T01:01:01Z'
- type: string
example: keyword
- type: boolean
example: true
example:
keyword: string
description: metadata associated to the incident.
properties: {}
scores:
type: object
additionalProperties:
type: number
format: double
example: 10.0
description: A non-negative score number.
example:
asset: 10.0
description: Used to indicate the severity or impact score of the threat represented by the incident.
properties: {}
categories:
type: array
items:
type: string
example: Attrition
example:
- Attrition
description: A set of categories for this incident.
discovery_method:
type: string
example: Agent Disclosure
description: Identifies how the incident was discovered.
intended_effect:
type: string
example: Account Takeover
description: Specifies the suspected intended effect of this incident
assignees:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: A set of owners assigned to this incident.
detection_sources:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: A set of sources that contributed threat detections to the incident.
promotion_method:
type: string
enum:
- Automated
- Manual
example: Automated
description: Describes method for promoting an Incident, whether manually or automatically. An Incident may be created manually by a SOAR analyst or SOC operator, or through an automated correlation or aggregation rule or engine that matches a specific set of events or alerts, and promotes them to Incident(s).
detection_status:
type: string
enum:
- active
- inactive_expired
- inactive_merged
- inactive_oversized
- inactive_user_closed
example: active
description: Represents the state of an incident within the incident generation process, indicating whether the incident is actively receiving updates or is no longer being updated.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
description: "Represents the potential impact of an incident on an organization's security posture and business operations. It helps organizations prioritize and allocate resources for incident response based on the severity level of the incident \nIt helps analysts and incident handlers prioritize incidents by indicating the level of risk and potential impact associated with the incident. This enables organizations to allocate resources efficiently and address the most critical incidents first.\nCan also be used to generate reports and metrics for measuring the effectiveness of the incident response process and to identify trends and patterns in the threat landscape.\nIt is important to note that the `severity` field is subjective and can be interpreted differently by different organizations or analysts. Therefore, it should be used in conjunction with other intelligence attributes, such as the `confidence` field, to provide a more comprehensive view of the incident."
tactics:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Represents the offensive techniques, approaches, or procedures that an adversary may use to achieve their objectives during an attack. It helps in understanding the intent and capabilities of the adversary and can be used to identify indicators of attack (IoAs) or indicators of compromise (IoCs) that are associated with the adversary's tactics.
techniques:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Represents the specific methods or actions used by an attacker to carry out an offensive maneuver or achieve their goals.
short_id:
type: string
example: string
description: A human-readable, short identifier for the incident, unique within an organization.
required:
- confidence
- status
- incident_time
example:
description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
description: For submitting a new Incident.
uniqueItems: true
example:
- description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
description: a list of `NewIncident`s.
indicators:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- indicator
example: indicator
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which this Indicator is considered valid.
producer:
type: string
example: string
description: String with at most 1024 characters.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
negate:
type: boolean
example: true
description: Specifies the absence of the pattern.
indicator_type:
type: array
items:
type: string
enum:
- Anonymization
- C2
- Compromised PKI Certificate
- Domain Watchlist
- Exfiltration
- File Hash Watchlist
- Host Characteristics
- IMEI Watchlist
- IMSI Watchlist
- IP Watchlist
- Login Name
- Malicious E-mail
- Malware Artifacts
- Private Threat Feed
- URL Watchlist
example: Anonymization
example:
- Anonymization
description: Specifies the type or types for this Indicator.
tags:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Descriptors for this indicator.
composite_indicator_expression:
type: object
properties:
operator:
type: string
enum:
- and
- not
- or
example: and
indicator_ids:
type: array
items:
type: string
example: string
description: A URI leading to an indicator.
example:
- string
required:
- operator
- indicator_ids
example:
operator: and
indicator_ids:
- string
likely_impact:
type: string
example: string
description: Likely potential impact within the relevant context if this Indicator were to occur.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: level of confidence held in the accuracy of this Indicator.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: Relevant kill chain phases indicated by this Indicator.
test_mechanisms:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
specification:
type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
x-anyOf:
- type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
- type: object
properties:
type:
type: string
enum:
- ThreatBrain
example: ThreatBrain
query:
type: string
example: string
variables:
type: array
items:
type: string
example: string
example:
- string
required:
- type
- variables
example:
type: ThreatBrain
query: string
variables:
- string
description: An indicator which runs in threatbrain...
- type: object
properties:
type:
type: string
enum:
- Snort
example: Snort
snort_sig:
type: string
example: string
required:
- type
- snort_sig
example:
type: Snort
snort_sig: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- SIOC
example: SIOC
SIOC:
type: string
example: string
required:
- type
- SIOC
example:
type: SIOC
SIOC: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- OpenIOC
example: OpenIOC
open_IOC:
type: string
example: string
required:
- type
- open_IOC
example:
type: OpenIOC
open_IOC: string
description: An indicator which contains an XML blob of an openIOC indicator.
required:
- producer
example:
description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: For submitting a new Indicator
uniqueItems: true
example:
- description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: a list of `NewIndicator`s.
judgements:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- judgement
example: judgement
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
disposition:
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Matches :disposition_name as in {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}
disposition_name:
type: string
enum:
- Clean
- Common
- Malicious
- Suspicious
- Unknown
example: Clean
description: String verdict identifiers.
priority:
type: integer
format: int64
example: 10
description: A value 0-100 that determine the priority of a judgement. Curated feeds of black/white lists, for example known good products within your organizations, should use a 95. All automated systems should use a priority of 90, or less. Human judgements should have a priority of 100, so that humans can always override machines.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
reason:
type: string
example: string
description: String with at most 1024 characters.
reason_uri:
type: string
example: string
description: A URI
required:
- source
- observable
- priority
- confidence
- severity
example:
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
description: Schema for submitting new Judgements.
uniqueItems: true
example:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
description: a list of `NewJudgement`s.
malwares:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- malware
example: malware
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
labels:
type: array
items:
type: string
example: adware
description: Malware label is an open vocabulary that represents different types and functions of malware. Malware labels are not mutually exclusive; a malware instance can be both spyware and a screen capture tool.
example:
- adware
description: The type of malware being described.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: The list of Kill Chain Phases for which this Malware can be used.
x_mitre_aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Software.aliases.
abstraction_level:
type: string
enum:
- family
- variant
- version
example: family
description: Malware abstraction level.
required:
- title
- description
- short_description
- labels
example:
description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new Malware.
uniqueItems: true
example:
- description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewMalware`s.
notes:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- note
example: note
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
note_class:
type: string
example: keyword
content:
type: string
example: string
description: Markdown string with at most 5000 characters.
related_entities:
type: array
items:
type: object
properties:
entity_type:
type: string
example: string
entity_id:
type: string
example: string
description: A URI leading to an entity.
required:
- entity_type
- entity_id
example:
entity_type: string
entity_id: string
example:
- entity_type: string
entity_id: string
author:
type: string
example: string
required:
- note_class
- content
- related_entities
example:
schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
description: Schema for submitting Notes
uniqueItems: true
example:
- schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
description: a list of `NewNote`s.
relationships:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- relationship
example: relationship
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
relationship_type:
type: string
example: attributed-to
source_ref:
type: string
example: string
description: A URI leading to an entity.
target_ref:
type: string
example: string
description: A URI leading to an entity.
required:
- relationship_type
- source_ref
- target_ref
example:
description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
description: Schema for submitting new Relationships.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
description: a list of `NewRelationship`s.
sightings:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- sighting
example: sighting
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
count:
type: integer
format: int64
example: 10
description: 'The number of times an indicator was observed within a certain period of time.
For example, if an IP address associated with known malicious activity is observed once within a period of time, it may indicate a low-level threat. However, if the same IP address is observed multiple times within a short time frame, it may indicate a more severe and persistent threat.
It can also be used to prioritize security alerts and indicate the urgency of a response. High counts indicate that an indicator is actively being used in a larger campaign, while low counts may indicate isolated incidents.'
internal:
type: boolean
example: false
description: "If `true`, indicates that the sighting was reported from internal sources, such as an organization's own internal security tools or SOC.\n Internal sightings are often considered more reliable and actionable than external sightings, which are reported from external sources and may have a lower level of trustworthiness. Internal sightings can provide more context and can help identify potential threats that are unique to a particular environment or organization.\n Internal sightings can also help organizations prioritize their security response efforts by identifying threats that are specific to their environment and may not yet be widely known."
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
resolution:
type: string
example: detected
description: Represents the disposition or actions taken on the associated threat intelligence.
data:
type: object
properties:
columns:
type: array
items:
type: object
properties:
name:
type: string
example: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
example: integer
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
type: boolean
example: true
description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`.
short_description:
type: string
example: string
required:
- name
- type
example:
name: string
type: integer
description: string
required: true
short_description: string
example:
- name: string
type: integer
description: string
required: true
short_description: string
description: an ordered list of column definitions
rows:
type: array
items:
type: array
items:
example: anything
example:
- - anything
description: an ordered list of rows
row_count:
type: integer
format: int64
example: 10
description: The number of rows in the data table.
required:
- columns
- rows
example:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: An embedded data table for the Sighting.
sensor:
type: string
example: endpoint
description: The OpenC2 Actuator name that best fits the device that is creating this sighting (e.g. network.firewall)
sensor_coordinates:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
os:
type: string
example: string
required:
- type
- observables
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
description: Describes the device that made the sighting (sensor) and contains identifying observables for the sensor.
targets:
type: array
items:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
os:
type: string
example: string
required:
- type
- observables
- observed_time
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
description: Describes the target of the sighting and contains identifying observables for the target.
example:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
description: 'May include one or more targets that observed the associated indicator. Targets can include network devices, host devices, or other entities that are capable of detecting indicators of compromise.
Can be used to assess the scope of potential threats, helping analysts understand which devices or components of the network may be vulnerable to attack. For example, if a particular malware strain is detected on several different systems within an organization, the `targets` field may indicate which systems are affected and which may need to be isolated or patched to prevent further spread.'
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
description: The object(s) of interest.
relations:
type: array
items:
type: object
properties:
origin:
type: string
example: string
origin_uri:
type: string
example: string
description: A URI
relation:
type: string
example: Allocated
relation_info:
type: object
additionalProperties:
example: anything
example:
keyword: anything
properties: {}
source:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
related:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
required:
- origin
- relation
- source
- related
example:
origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
description: A relation inside a Sighting.
example:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
description: Provide any context we can about where the observable came from.
context:
type: object
properties:
process_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- ProcessCreateEvent
example: ProcessCreateEvent
process_args:
type: string
example: string
description: String with at most 2048 characters.
process_hash:
type: string
example: string
description: String with at most 2048 characters.
process_size:
type: integer
format: int64
example: 10
process_disposition:
type: string
example: string
description: String with at most 1024 characters.
parent_creation_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
parent_process_id:
type: integer
format: int64
example: 10
parent_process_guid:
type: integer
format: int64
example: 10
parent_process_name:
type: string
example: string
description: String with at most 1024 characters.
parent_process_args:
type: string
example: string
description: String with at most 2048 characters.
parent_process_username:
type: string
example: string
description: String with at most 1024 characters.
parent_process_hash:
type: string
example: string
description: String with at most 2048 characters.
parent_process_size:
type: integer
format: int64
example: 10
parent_process_disposition:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- type
example:
parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
example:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
description: a list of `ProcessCreate`
library_load_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- LibraryLoadEvent
example: LibraryLoadEvent
dll_library_name:
type: string
example: string
description: String with at most 1024 characters.
dll_library_path:
type: string
example: string
description: String with at most 2048 characters.
required:
- time
- process_id
- process_name
- type
- dll_library_name
- dll_library_path
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
description: a list of `LibraryLoadType`
file_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileCreateEvent
example: FileCreateEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileCreateType`
file_delete_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileDeleteEvent
example: FileDeleteEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileDeleteType`
file_modify_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileModifyEvent
example: FileModifyEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileModifyType`
file_move_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileMoveEvent
example: FileMoveEvent
old_name:
type: string
example: string
description: String with at most 1024 characters.
new_name:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
- old_name
- new_name
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
description: a list of `FileMoveType`
netflow_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- NetflowEvent
example: NetflowEvent
traffic:
type: object
properties:
protocol:
type: integer
format: int64
example: 10
description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
source_ip:
type: string
example: string
destination_ip:
type: string
example: string
source_port:
type: integer
format: int64
example: 10
destination_port:
type: integer
format: int64
example: 10
direction:
type: string
enum:
- incoming
- outgoing
example: incoming
destination_host_name:
type: string
example: string
source_subnet:
type: string
example: string
destination_subnet:
type: string
example: string
required:
- protocol
- source_ip
- destination_ip
- source_port
- destination_port
- direction
example:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
process_path:
type: string
example: string
description: String with at most 1024 characters.
process_args:
type: string
example: string
description: String with at most 1024 characters.
process_hash:
type: string
example: string
description: String with at most 1024 characters.
process_account_type:
type: string
example: string
description: String with at most 1024 characters.
process_account:
type: string
example: string
description: String with at most 1024 characters.
parent_process_id:
type: integer
format: int64
example: 10
parent_process_name:
type: string
example: string
description: String with at most 1024 characters.
parent_process_path:
type: string
example: string
description: String with at most 1024 characters.
parent_process_args:
type: string
example: string
description: String with at most 1024 characters.
parent_process_hash:
type: string
example: string
description: String with at most 1024 characters.
parent_process_account:
type: string
example: string
description: String with at most 1024 characters.
parent_process_account_type:
type: string
example: string
description: String with at most 1024 characters.
flow_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
byte_count_out:
type: integer
format: int64
example: 10
byte_count_in:
type: integer
format: int64
example: 10
required:
- time
- process_id
- process_name
- type
- traffic
example:
parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
example:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
description: a list of `NetflowType`
http_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- HTTPEvent
example: HTTPEvent
host:
type: string
example: string
description: String with at most 1024 characters.
traffic:
type: object
properties:
protocol:
type: integer
format: int64
example: 10
description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
source_ip:
type: string
example: string
destination_ip:
type: string
example: string
source_port:
type: integer
format: int64
example: 10
destination_port:
type: integer
format: int64
example: 10
direction:
type: string
enum:
- incoming
- outgoing
example: incoming
destination_host_name:
type: string
example: string
source_subnet:
type: string
example: string
destination_subnet:
type: string
example: string
required:
- protocol
- source_ip
- destination_ip
- source_port
- destination_port
- direction
example:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
url_port:
type: integer
format: int64
example: 10
query:
type: string
example: string
description: String with at most 5000 characters.
encrypted:
type: boolean
example: true
method:
type: string
enum:
- CONNECT
- GET
- HEAD
- OPTIONS
- PATCH
- POST
- PUT
- TRACE
example: CONNECT
required:
- time
- process_id
- process_name
- type
- host
- traffic
example:
process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
example:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
description: a list of `HTTPType`
registry_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryCreateEvent
example: RegistryCreateEvent
required:
- time
- process_id
- process_name
- registry_key
- type
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
description: a list of `RegistryCreateType`
registry_set_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistrySetEvent
example: RegistrySetEvent
registry_value:
type: string
example: string
description: String with at most 2048 characters.
registry_data_length:
type: integer
format: int64
example: 10
registry_data:
type: string
example: string
description: String with at most 5000 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
- registry_value
example:
process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
example:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
description: a list of `RegistrySetType`
registry_delete_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryDeleteEvent
example: RegistryDeleteEvent
registry_value:
type: string
example: string
description: String with at most 2048 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
description: a list of `RegistryDeleteType`
registry_rename_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryRenameEvent
example: RegistryRenameEvent
registry_old_key:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
- registry_old_key
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
description: a list of `RegistryRenameType`
example:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
description: Context including the event type that best fits the type of the sighting.
activity_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the malicious activity occurred. For example, the time when a malware sample was executing, or the time range of a network intrusion.
detection_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the malicious activity was detected by the source engine or security tool. This may differ from the activity_interval if detection occurred after the activity.
modification_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the sighting record was created or last updated in the system.
required:
- observed_time
example:
description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: For submitting a new Sighting.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: a list of `NewSighting`s.
identity_assertions:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- identity-assertion
example: identity-assertion
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
identity:
type: object
properties:
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
required:
- observables
example:
observables:
- value: 1.2.3.4
type: ip
description: Attributes for which the assertion is being made.
assertions:
type: array
items:
type: object
properties:
name:
type: string
example: cisco:ctr:ad:host_domain_name
description: An open vocabulary containing well known assertion types
value:
type: string
example: string
required:
- name
- value
example:
name: cisco:ctr:ad:host_domain_name
value: string
example:
- name: cisco:ctr:ad:host_domain_name
value: string
description: Any known context about the identity attributes.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- identity
- assertions
example:
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
description: For submitting a new IdentityAssertion.
uniqueItems: true
example:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
description: a list of `NewIdentityAssertion`s.
target_records:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- target-record
example: target-record
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
targets:
type: array
items:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
os:
type: string
example: string
description: Source Operating System where TargetRecord was originated.
internal:
type: boolean
example: false
description: Is it internal to our network?
sensor:
type: string
example: string
description: 'The OpenC2 Actuator name that best fits the device that is creating this TargetRecord (e.g.: network.firewall, etc.)'
source_uri:
type: string
example: string
description: A URI
required:
- type
- observables
- observed_time
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
description: Schema for TargetRecord Targets
example:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
required:
- source
- targets
example:
description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new TargetRecord.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewTargetRecord`s.
tools:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- tool
example: tool
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
labels:
type: array
items:
type: string
example: credential-exploitation
description: Tool labels describe the categories of tools that can be used to perform attacks.
example:
- credential-exploitation
description: The kind(s) of tool(s) being described.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: The list of kill chain phases for which this Tool can be used.
tool_version:
type: string
example: string
description: The version identifier associated with the Tool.
x_mitre_aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Software.aliases.
required:
- title
- description
- short_description
- labels
example:
description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new Tool.
uniqueItems: true
example:
- description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewTool`s.
verdicts:
type: array
items:
type: object
properties:
type:
type: string
enum:
- verdict
example: verdict
disposition:
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Numeric verdict identifiers.
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
disposition_name:
type: string
enum:
- Clean
- Common
- Malicious
- Suspicious
- Unknown
example: Clean
description: 'The disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}'
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- type
- disposition
- observable
- valid_time
example:
type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: "A Verdict is chosen from all of the Judgements on that Observable which have not yet expired. The highest priority Judgement becomes the active verdict. If there is more than one Judgement with that priority, then Clean disposition has priority over all others, then Malicious disposition, and so on down to Unknown.\n\n The ID of a verdict is a a str of the form \"observable.type:observable.value\" for example, \"ip:1.1.1.1\""
uniqueItems: true
example:
- type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: a list of `Verdict`s.
data_tables:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- data-table
example: data-table
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
columns:
type: array
items:
type: object
properties:
name:
type: string
example: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
example: integer
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
type: boolean
example: true
description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`.
short_description:
type: string
example: string
required:
- name
- type
example:
name: string
type: integer
description: string
required: true
short_description: string
example:
- name: string
type: integer
description: string
required: true
short_description: string
description: An ordered list of column definitions.
rows:
type: array
items:
type: array
items:
example: anything
example:
- - anything
description: An ordered list of rows
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
row_count:
type: integer
format: int64
example: 10
description: The number of rows in the data table.
required:
- columns
- rows
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting a NewDataTable record.
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewDataTable`s.
weaknesses:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- weakness
example: weakness
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: Should be short and limited to the key points that define this weakness.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
structure:
type: string
enum:
- Chain
- Composite
- Simple
example: Chain
description: Defines the structural nature of the weakness.
languages:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Language name (Clojure, Java, ...)
class:
type: string
example: Assembly
description: Class of language.
required:
- prevalence
example:
prevalence: Often
name: string
class: Assembly
example:
- prevalence: Often
name: string
class: Assembly
description: Applicable Languages.
operating_systems:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: String with at most 1024 characters.
version:
type: string
example: string
description: String with at most 1024 characters.
cpe_id:
type: string
example: string
description: String with at most 1024 characters.
class:
type: string
example: Android
description: Class of Operating System.
required:
- prevalence
example:
prevalence: Often
name: string
version: string
cpe_id: string
class: Android
example:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
description: Applicable operating systems.
architectures:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Architecture name (ARM, x86, ...)
class:
type: string
example: Embedded
description: Class of architecture
required:
- prevalence
example:
prevalence: Often
name: string
class: Embedded
example:
- prevalence: Often
name: string
class: Embedded
description: Applicable architectures.
paradigms:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Paradigm name (Client Server, Mainframe)
required:
- prevalence
example:
prevalence: Often
name: string
example:
- prevalence: Often
name: string
description: Applicable paradigms.
technologies:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Technology name (Web Server, Web Client)
required:
- prevalence
example:
prevalence: Often
name: string
example:
- prevalence: Often
name: string
description: Applicable technologies.
background_details:
type: string
example: string
description: Information that is relevant but not related to the nature of the weakness itself.
alternate_terms:
type: array
items:
type: object
properties:
term:
type: string
example: string
description: The actual alternate term.
description:
type: string
example: string
description: Provides context for the alternate term by which this weakness may be known.
required:
- term
example:
term: string
description: string
example:
- term: string
description: string
description: Indicates one or more other names used to describe this weakness.
modes_of_introduction:
type: array
items:
type: object
properties:
phase:
type: string
example: Architecture and Design
description: Identifies the point in the software life cycle at which the weakness may be introduced.
note:
type: string
example: string
description: Provides a typical scenario related to introduction during the given phase.
required:
- phase
example:
phase: Architecture and Design
note: string
example:
- phase: Architecture and Design
note: string
description: Information about how and when a given weakness may be introduced.
likelihood:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Likelihood of exploit.
common_consequences:
type: array
items:
type: object
properties:
scopes:
type: array
items:
type: string
example: Access Control
description: Defines the different areas of software security that can be affected by exploiting a weakness.
example:
- Access Control
description: Identifies the security property that is violated.
impacts:
type: array
items:
type: string
example: Alter Execution Logic
example:
- Alter Execution Logic
description: Describes the technical impact that arises if an adversary succeeds in exploiting this weakness.
likelihood:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: How likely the specific consequence is expected to be seen relative to the other consequences.
note:
type: string
example: string
description: Additional commentary about a consequence.
required:
- scopes
example:
scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
example:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
description: Refers to the typical or expected negative effects that can result from exploiting the weakness. This could include anything from unauthorized access to data, denial of service, system crashes or other things.
detection_methods:
type: array
items:
type: object
properties:
method:
type: string
example: Architecture or Design Review
description: Identifies the particular detection method being described.
description:
type: string
example: string
description: Provides some context of how this method can be applied to a specific weakness.
effectiveness:
type: string
example: High
description: How effective the detection method may be in detecting the associated weakness.
effectiveness_notes:
type: string
example: string
description: Provides additional discussion of the strengths and shortcomings of this detection method.
required:
- method
- description
example:
method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
example:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
description: Identifies methods that may be employed to detect this weakness, including their strengths and limitations.
potential_mitigations:
type: array
items:
type: object
properties:
description:
type: string
example: string
description: A description of this individual mitigation including any strengths and shortcomings of this mitigation for the weakness.
phases:
type: array
items:
type: string
example: Architecture and Design
description: Defines the different regularities that guide the applicability of platforms.
example:
- Architecture and Design
description: Indicates the development life cycle phase during which this particular mitigation may be applied.
strategy:
type: string
example: Attack Surface Reduction
description: A general strategy for protecting a system to which this mitigation contributes.
effectiveness:
type: string
example: Defense in Depth
description: Summarizes how effective the mitigation may be in preventing the weakness.
effectiveness_notes:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
- description
example:
description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
example:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
description: Describes potential mitigations associated with a weakness.
functional_areas:
type: array
items:
type: string
example: Authentication
description: Defines the different functional areas of software in which the weakness may appear.
example:
- Authentication
description: Identifies the functional area of the software in which the weakness is most likely to occur.
affected_resources:
type: array
items:
type: string
example: CPU
description: Defines a resource of a system.
example:
- CPU
description: Identifies system resources that can be affected by an exploit of this weakness.
notes:
type: array
items:
type: object
properties:
type:
type: string
example: Applicable Platform
description: Defines the different types of notes that can be associated with a weakness.
note:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
- type
- note
example:
type: Applicable Platform
note: string
example:
- type: Applicable Platform
note: string
description: Provides any additional comments about the weakness.
abstraction_level:
type: string
enum:
- Base
- Class
- Compound
- Variant
example: Base
description: Refers to the level of abstraction or granularity used to describe the weakness. It helps to categorize the vulnerability based on the level of detail provided.
required:
- description
example:
description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
description: For submitting a new weakness.
uniqueItems: true
example:
- description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
description: a list of `NewWeakness`s.
vulnerabilities:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- vulnerability
example: vulnerability
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: "Various sources of vulnerability information can be used, including third-party resources like the National Vulnerability Database (NVD) and the Common Vulnerabilities and Exposures (CVE) database. The platform then analyzes this data and provides the user with relevant details such as the severity of the vulnerability, the affected systems, and remediation recommendations. \n\n Based on this information, the user can prioritize patching and other mitigation strategies to reduce the risk of potential attacks."
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
cve:
type: object
properties:
cve_data_meta:
type: object
properties:
id:
type: string
example: string
description: String with at most 1024 characters.
assigner:
type: string
example: string
description: String with at most 1024 characters.
example:
id: string
assigner: string
required:
- cve_data_meta
example:
cve_data_meta:
id: string
assigner: string
impact:
type: object
properties:
cvss_v2:
type: object
properties:
vector_string:
type: string
example: string
description: a text representation of a set of CVSSv2 metrics. It is commonly used to record or transfer CVSSv2 metric information in a concise form
base_score:
type: number
format: double
example: 10.0
description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v2/guide'
base_severity:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
impact_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
exploitability_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
access_vector:
type: string
enum:
- adjacent network
- local
- network
example: network
description: This metric reflects how the vulnerability is exploited.The more remote an attacker can be to attack a host, the greater the vulnerability score.
access_complexity:
type: string
enum:
- high
- low
- medium
example: low
description: 'This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system. For example, consider a buffer overflow in an Internet service: once the target system is located, the attacker can launch an exploit at will.'
authentication:
type: string
enum:
- multiple
- none
- single
example: none
description: This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. This metric does not gauge the strength or complexity of the authentication process, only that an attacker is required to provide credentials before an exploit may occur. The fewer authentication instances that are required, the higher the vulnerability score.
confidentiality_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact on confidentiality of a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. Increasedconfidentiality impact increases the vulnerability score.
integrity_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information. Increased integrity impact increases the vulnerability score.
availability_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact to availability of a successfully exploited vulnerability. Availability refers to the accessibility of information resources. Attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system. Increased availability impact increases the vulnerability score.
exploitability:
type: string
enum:
- functional
- high
- not_defined
- proof_of_concept
- unproven
example: not_defined
description: This metric measures the current state of exploit techniques or code availability. Public availability of easy-to-use exploit code increases the number of potential attackers by including those who are unskilled thereby increasing the severity of the vulnerability.
remediation_level:
type: string
enum:
- not_defined
- official_fix
- temporary_fix
- unavailable
- workaround
example: not_defined
description: The remediation level of a vulnerability is an important factor for prioritization. The typical vulnerability is unpatched when initially published. Workarounds or hotfixes may offer interim remediation until an official patch or upgrade is issued. Each of these respective stages adjusts the temporal score downwards, reflecting the decreasing urgency as remediation becomes final. The less official and permanent a fix, the higher the vulnerability score is.
report_confidence:
type: string
enum:
- confirmed
- not_defined
- unconfirmed
- uncorroborated
example: not_defined
description: This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details. Sometimes, only the existence of vulnerabilities are publicized, but without specific details. The vulnerability may later be corroborated and then confirmed through acknowledgement by the author or vendor of the affected technology. The urgency of a vulnerability is higher when a vulnerability is known to exist with certainty. This metric also suggests the level of technical knowledge available to would-be attackers. The more a vulnerability is validated by the vendor or other reputable sources, the higher the score.
temporal_vector_string:
type: string
example: string
description: A text representation of a set of CVSSv2 temporal metrics. Temporal metrics allow analysists to calculate threat severity based on temporal factors such as reliability of vulnerability reports, availability of mitigations, and the ease or difficulty of conducting the exploit. It is commonly used to record or transfer CVSSv2 metric information in a concise form
collateral_damage_potential:
type: string
enum:
- high
- low
- low_medium
- medium_high
- none
- not_defined
example: not_defined
description: This metric measures the potential for loss of life or physical assets through damage or theft of property or equipment. The metric may also measure economic loss of productivity or revenue. Naturally, the greater the damage potential, the higher the vulnerability score.
target_distribution:
type: string
enum:
- high
- low
- medium
- none
- not_defined
example: not_defined
description: This metric measures the proportion of vulnerable systems. It is meant as an environment-specific indicator in order to approximate the percentage of systems that could be affected by the vulnerability. The greater the proportion of vulnerable systems, the higher the score.
confidentiality_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
integrity_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
availability_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
environmental_vector_string:
type: string
example: string
description: A text representation of a set of CVSSv2 environmental metrics. Environmental metrics allow analysists to calculate threat scores in relation to environmental security requirements, collateral damage potential, and target availability. It is commonly used to record or transfer CVSSv2 metric information in a concise form
obtain_all_privilege:
type: boolean
example: true
obtain_user_privilege:
type: boolean
example: true
obtain_other_privilege:
type: boolean
example: true
user_interaction_required:
type: boolean
example: true
required:
- vector_string
- base_score
- base_severity
example:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
type: object
properties:
vector_string:
type: string
example: string
description: a text representation of a set of CVSSv3 metrics. It is commonly used to record or transfer CVSSv3 metric information in a concise form
base_score:
type: number
format: double
example: 10.0
description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v3-1'
base_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
impact_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
exploitability_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
attack_vector:
type: string
enum:
- adjacent_network
- local
- network
- physical
example: adjacent_network
description: Reflects the context by which vulnerability exploitation is possible
modified_attack_vector:
type: string
enum:
- adjacent_network
- local
- network
- not_defined
- physical
example: not_defined
description: modified attack vector
attack_complexity:
type: string
enum:
- high
- low
example: high
description: describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability
modified_attack_complexity:
type: string
enum:
- high
- low
- not_defined
example: not_defined
description: modified attack complexity
privileges_required:
type: string
enum:
- high
- low
- none
example: high
description: describes the level of privileges an attacker must possess before successfully exploiting the vulnerability
modified_privileges_required:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified privileges required
user_interaction:
type: string
enum:
- none
- required
example: none
description: captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component
modified_user_interaction:
type: string
enum:
- none
- not_defined
- required
example: none
description: modified user interaction
scope:
type: string
enum:
- changed
- unchanged
example: changed
description: the ability for a vulnerability in one software component to impact resources beyond its means, or privileges
modified_scope:
type: string
enum:
- changed
- not_defined
- unchanged
example: not_defined
description: modified scope
confidentiality_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability
modified_confidentiality_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified confidentiality impact
integrity_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to integrity of a successfully exploited vulnerability
modified_integrity_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified integrity impact
availability_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability
modified_availability_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified availability impact
exploit_code_maturity:
type: string
enum:
- functional
- high
- not_defined
- proof_of_concept
- unproven
example: functional
description: measures the likelihood of the vulnerability being attacked
remediation_level:
type: string
enum:
- high
- not_defined
- offical_fix
- temporary_fix
- unavailable
- workaround
example: high
description: Remediation Level of a vulnerability is an important factor for prioritization
report_confidence:
type: string
enum:
- confirmed
- reasonable
- unknown
example: confirmed
description: measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details
temporal_score:
type: number
format: double
example: 10.0
description: Round up(CVSSv3BaseScore × CVSSv3ExploitCodeMaturity × CVSSv3RemediationLevel × CVSSv3ReportConfidence)
temporal_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
description: temporal severity
availability_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
confidentiality_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
integrity_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
environmental_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
environmental_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
required:
- vector_string
- base_score
- base_severity
example:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
example:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: "Describes the potential impact of a vulnerability that is being tracked in the system. Provides information on the extent of damage that a vulnerability can cause and how serious the consequences could be if it is exploited. \n\nMay contain granular information about the vulnerability severity using the CVSS system, versions 2 and 3.\n\nCVSSv2 and CVSSv3 have different methods of calculating base scores, but both are designed to provide an indication of the level of risk that a vulnerability poses. The base score ranges from 0 to 10, with 10 being the most severe. Additionally, both CVSSv2 and CVSSv3 define severity levels, such as low, medium, high, and critical, based on the base score."
configurations:
type: object
properties:
CVE_data_version:
type: string
example: string
description: Specifies the version of the CVE (Common Vulnerabilities and Exposures) dictionary used by the vulnerability information provider.
nodes:
type: array
items:
type: object
properties:
operator:
type: string
enum:
- AND
- OR
example: AND
description: The operator string influences how seqs of cpe matches are related to one another.
cpe_match:
type: array
items:
type: object
properties:
vulnerable:
type: boolean
example: true
cpe23Uri:
type: string
example: string
description: A text representation of a software or hardware platform.
versionStartIncluding:
type: string
example: string
description: A string representing the lower bound(inclusive) of version in the CPE.
versionEndIncluding:
type: string
example: string
description: A string representing the upper bound(inclusive) of version in the CPE.
versionStartExcluding:
type: string
example: string
description: A string representing the lower bound(exclusive) of version in the CPE.
versionEndExcluding:
type: string
example: string
description: A string representing the upper bound(exclusive) of version in the CPE.
required:
- vulnerable
- cpe23Uri
example:
vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
example:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
type: array
items:
type: object
properties:
operator:
type: string
enum:
- AND
- OR
example: AND
description: The operator string influences how seqs of cpe matches are related to one another.
cpe_match:
type: array
items:
type: object
properties:
vulnerable:
type: boolean
example: true
cpe23Uri:
type: string
example: string
description: A text representation of a software or hardware platform.
versionStartIncluding:
type: string
example: string
description: A string representing the lower bound(inclusive) of version in the CPE.
versionEndIncluding:
type: string
example: string
description: A string representing the upper bound(inclusive) of version in the CPE.
versionStartExcluding:
type: string
example: string
description: A string representing the lower bound(exclusive) of version in the CPE.
versionEndExcluding:
type: string
example: string
description: A string representing the upper bound(exclusive) of version in the CPE.
required:
- vulnerable
- cpe23Uri
example:
vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
example:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate:
type: boolean
example: true
description: Negates operator when true.
required:
- operator
- cpe_match
example:
operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
example:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate:
type: boolean
example: true
description: Negates operator when true.
required:
- operator
example:
operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
example:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
description: Each `node` in the CTIM standard configuration includes information such as the `operator` (such as "less than", or "greater than or equal to"), and the `cpe` (Common Platform Enumeration) string which identifies the specific software, `CPE` is a structured naming scheme for IT systems, platforms, and software packages, and it is instrumental in enabling data exchange between different systems.
required:
- CVE_data_version
- nodes
example:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
description: "Represents a list of affected versions or configurations of a software component that is impacted by a vulnerability. \nBy tracking the affected software components and versions, defenders can identify which systems are potentially exposed to an attack, and apply appropriate mitigations."
published_date:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: "Represents the date when a vulnerability was publicly disclosed or made available to the general public. \n\nImportant for tracking the age of a vulnerability, as well as for determining when a particular vulnerability was first introduced into a system. The published date can be used to identify the time window during which a system may have been vulnerable to a particular exploit.\n\nFor example, if an organization discovers that a vulnerability was published before their system's installation date, but they did not apply the necessary security updates in a timely manner, it can be concluded that their system was vulnerable for the period between the installation date and the date when the necessary security updates were applied."
last_modified_date:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: 'Represents the date when the vulnerability metadata was last updated in the internal database.
It can be used to track the freshness of the vulnerability information. If the `last_modified_date` is more recent than the `published_date`, it can indicate that there has been some new information or updates related to the vulnerability, such as new patch releases or changes in the severity or impact rating.'
required:
- description
example:
description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: For submitting a new vulnerability.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: a list of `NewVulnerability`s.
actor_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_mapping_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_properties_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
attack_pattern_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
campaign_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
coa_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
feedback_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
identity_assertion_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
incident_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
indicator_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
judgement_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
malware_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
note_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
relationship_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
sighting_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
target_record_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
tool_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
verdict_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
data_table_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
weakness_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
vulnerability_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- source
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
asset_mapping_refs:
- string
note_refs:
- string
data_table_refs:
- string
attack_pattern_refs:
- string
sighting_refs:
- string
schema_version: 1.3.30
revision: 10
assets:
- description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
weakness_refs:
- string
tool_refs:
- string
target_record_refs:
- string
asset_refs:
- string
tools:
- description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
indicators:
- description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
attack_patterns:
- description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
type: bundle
weaknesses:
- description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
source: string
external_ids:
- string
feedback_refs:
- string
asset_properties:
- properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
short_description: string
feedbacks:
- feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
judgement_refs:
- string
title: string
coa_refs:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
verdicts:
- type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
campaigns:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
source_uri: string
actors:
- description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
indicator_refs:
- string
actor_refs:
- string
language: string
data_tables:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
id: string
notes:
- schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
identity_assertions:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
judgements:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
malwares:
- description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
target_records:
- description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
asset_mappings:
- asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
relationship_refs:
- string
tlp: green
incidents:
- description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
identity_assertion_refs:
- string
sightings:
- description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
campaign_refs:
- string
vulnerability_refs:
- string
asset_properties_refs:
- string
relationships:
- description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
timestamp: '2016-01-01T01:01:01Z'
verdict_refs:
- string
malware_refs:
- string
incident_refs:
- string
vulnerabilities:
- description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
coas:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: Describes a Bundle of any set of CTIM entities.
investigated_observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
source:
title: InvestigationSource
description: String with at most 1024 characters.
type: string
example: Cisco XDR Automated Question
title:
title: InvestigationTitle
description: String with at most 1024 characters.
type: string
example: Which devices in my org was this sha seen on?
description:
title: InvestigationDescription
description: String with at most 5000 characters.
type: string
example: 'For the following hashes:
- sha256:defg...1234
- sha256:abcd..1234
Determine which devices in my org have instances of the file in the past 30 days'
required:
- bundle
application/edn:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- bundle
example: bundle
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
actors:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- actor
example: actor
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Indicates the time span for which the information about the Actor is relevant, and after which it could become outdated.
actor_types:
type: array
items:
type: string
example: Cyber Espionage Operations
example:
- Cyber Espionage Operations
identity:
type: object
properties:
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
related_identities:
type: array
items:
type: object
properties:
identity:
type: string
example: string
description: The reference (URI) of the related Identity object.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Specifies the level of confidence in the assertion of the relationship between the two objects.
information_source:
type: string
example: string
description: Specifies the source of the information about the relationship between the two components.
relationship:
type: string
example: string
required:
- identity
example:
identity: string
confidence: High
information_source: string
relationship: string
description: Describes a related Identity
example:
- identity: string
confidence: High
information_source: string
relationship: string
description: Identifies other entity Identities related to this Identity.
required:
- description
- related_identities
example:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
description: Can contain information such as the name of the attacker, the group or organization they belong to, or any other identifier that can help in the attribution process.
motivation:
type: string
example: Ego
description: The reason or purpose behind the malicious activity attributed to this Actor. By understanding a threat actor's motivation, analysts can better predict the attacker's behavior and anticipate future malicious actions.
sophistication:
type: string
enum:
- Aspirant
- Expert
- Innovator
- Novice
- Practitioner
example: Aspirant
description: "Represents the level of expertise and skill that the threat actor has displayed in their malicious activities. Can help security analysts assess the potential impact of an attacker's TTPs and determine the potential attack surface. \n\nFor example, a threat actor with a low sophistication level may primarily rely on off-the-shelf malware and attack tools, while an attacker with high sophistication may use custom tools with advanced evasion techniques, zero-day exploits, and sophisticated methods for command and control of their malware. \n\nThe sophistication level of an attacker can also be inferred based on several factors such as the complexity of attacks, the attacker's knowledge of the targeted organization's systems, and the attacker's ability to remain undetected.\n\nIf an attacker shows a high level of sophistication in reconnaissances, social engineering, and phishing, then the attacker may have a good knowledge of the targeted organization and its employees. This means that the attacker may be more successful in infiltrating the organization's network and compromising its systems."
intended_effect:
type: string
example: Account Takeover
description: "Represents the desired outcome or impact the threat actor is trying to achieve through their malicious activities. \n\n Helps security analysts to understand the attacker's goals beyond the immediate impact of the attack. By understanding the intended effect, analysts can draw connections between seemingly unrelated attacks and build a more complete understanding of an attacker's long-term goals and motivations."
planning_and_operational_support:
type: string
example: string
description: "Provides information about the resources and capabilities of the attacker that could be used to assist in planning and operations related to the threat.\n\n It can be used to describe Infrastructure, Tools, Techniques, and Capabilities used by the threat actor."
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'This field can help analysts decide how much trust they can put in the information provided by the threat intelligence sources.
For example, an Actor entity can have high confidence if the organization''s security researchers have been tracking it for a long time and have gathered a significant amount of intelligence about it through various sources, such as analysis of malware, network traffic, and human intelligence. In contrast, low confidence may indicate the organization has only seen limited or circumstantial evidence.'
aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: A list of other names that this Threat Actor is believed to use.
required:
- source
- title
- description
- short_description
example:
description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
description: Schema for submitting new Actors
uniqueItems: true
example:
- description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
description: a list of `NewActor`s.
assets:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset
example: asset
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: 'Specifies the time range during which the asset is considered valid or accurate.
For example, if an asset entity represents a device, the `valid_time` field could be used to indicate the period during which the device''s configuration information is deemed accurate.'
asset_type:
type: string
enum:
- application
- data
- device
- network
- person
example: application
description: 'Type of the Asset: Device, Person, Application, etc.'
required:
- source
- valid_time
- asset_type
example:
description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new Assets
uniqueItems: true
example:
- description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAsset`s.
asset_mappings:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset-mapping
example: asset-mapping
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: For each asset, we allow for the assertion of time bound properties.This gives us both a record of the current state of the asset,as well as history.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'Level of confidence held in the characterization of this AssetMapping e.g.: is it susceptible to manipulation or translation?'
specificity:
type: string
enum:
- Low
- Medium
- Unique
example: Low
description: Denotes the level of how many assets potentially could have this same identifier.
stability:
type: string
enum:
- Managed
- Physical
- Temporary
example: Managed
description: Do we manage when it changes, or is it always a time bound assignment?
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: An AssetMapping is a record that a specific Observable maps to an Asset for an indicated period of time.
asset_ref:
type: string
example: string
description: URI that points to the mapped Asset.
asset_type:
type: string
enum:
- application
- data
- device
- network
- person
example: application
description: 'Type of the mapped Asset: Device, Person, Application, etc.'
required:
- source
- valid_time
- confidence
- specificity
- stability
- observable
- asset_ref
- asset_type
example:
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
description: Schema for submitting new AssetMapping.
uniqueItems: true
example:
- asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
description: a list of `NewAssetMapping`s.
asset_properties:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset-properties
example: asset-properties
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which the AssetProperties is considered valid.
asset_ref:
type: string
example: string
description: URI that points to the associated Asset.
properties:
type: array
items:
type: object
properties:
name:
type: string
example: string
description: The properties are an open vocabulary.
value:
type: string
example: string
required:
- name
- value
example:
name: string
value: string
example:
- name: string
value: string
required:
- source
- valid_time
- asset_ref
example:
properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new AssetProperties
uniqueItems: true
example:
- properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAssetProperties`s.
attack_patterns:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- attack-pattern
example: attack-pattern
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: A kill chain is a series of steps that an attacker must go through to successfully achieve their objective. The concept was originally developed by the military, but has been adapted to the cybersecurity field to describe the steps an attacker goes through to compromise a target system and achieve their goal.
x_mitre_data_sources:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Data Sources.
x_mitre_platforms:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Platforms.
x_mitre_contributors:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Contributors.
abstraction_level:
type: string
enum:
- aggregate
- category
- detailed
- meta
- standard
example: aggregate
description: The CAPEC abstraction level for patterns describing techniques to attack a system.
required:
- title
- description
- short_description
example:
description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new AttackPattern
uniqueItems: true
example:
- description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAttackPattern`s.
campaigns:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- campaign
example: campaign
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Timestamp for the definition of a specific version of a campaign.
campaign_type:
type: string
example: string
description: 'String value that describes the type of campaign. For example, a campaign type could be ''Ransomware'', ''Advanced Persistent Threat'', ''Business Email Compromise'', ''Phishing'', etc. '
names:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Used to capture alternate names or aliases associated with the campaign. A cyberattack campaign may have multiple names or aliases depending on the group or actor(s) behind the attack, e.g., 'Wannacry' is also known as 'WannaCrypt', 'WCry', 'Wanna Decryptor', etc.
intended_effect:
type: array
items:
type: string
example: Account Takeover
example:
- Account Takeover
description: Characterizes the intended effect of this cyber threat campaign.
status:
type: string
enum:
- Future
- Historic
- Ongoing
example: Future
description: "Indicates current Status of the Campaign. \n\nCan have one of the following values: \n\n- Ongoing: Indicates that the campaign is currently active and ongoing. For example, a mass phishing campaign that is actively targeting users is considered 'ongoing'.\n\n- Historic: Campaign has already occurred and is now in the past.\n\n- Future: This indicates that a campaign is planned or expected to occur in the future. For example, a threat actor may announce their intention to launch a specific cyberattack campaign at a future date."
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Level of confidence held in the characterization of this Campaign.
activity:
type: array
items:
type: object
properties:
date_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Specifies the date and time at which the activity occured.
description:
type: string
example: string
description: A description of the activity.
required:
- date_time
- description
example:
date_time: '2016-01-01T01:01:01Z'
description: string
description: Captures the specific activities or tactics associated with the entity. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc.
example:
- date_time: '2016-01-01T01:01:01Z'
description: string
description: 'Used to capture specific activities or tactics associated with the campaign.
The ''activity'' field is an array of objects, and each element represents a specific activity and time associated with the campaign. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc. By capturing these activities analysts can identify the specific tactics used by the threat actor(s) behind the campaign.'
required:
- title
- description
- short_description
- campaign_type
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
description: Schema for submitting new Campaigns
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
description: a list of `NewCampaign`s.
coas:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- coa
example: coa
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
stage:
type: string
enum:
- Containment
- Eradication
- Identification
- Lessons Learned
- Preparation
- Recovery
- Remedy
- Response
example: Containment
description: Specifies what stage in the cyber threat management lifecycle this Course Of Action is relevant to.
coa_type:
type: string
enum:
- Diplomatic Actions
- Eradication
- Hardening
- Internal Blocking
- Logical Access Restrictions
- Monitoring
- Other
- Patching
- Perimeter Blocking
- Phase
- Physical Access Restrictions
- Playbook
- Policy Actions
- Public Disclosure
- Rebuilding
- Redirection
- Redirection (Honey Pot)
- Task
- Training
example: Diplomatic Actions
description: The type of this COA
objective:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Characterizes the objective to provide guidance on how to mitigate a security incident that has been identified.
impact:
type: string
example: string
description: Characterizes the estimated impact of applying this course of action.
cost:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Characterizes the estimated cost for applying this course of action.
efficacy:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Effectiveness of this course of action in achieving its targeted objective.
related_COAs:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
COA_id:
type: string
example: string
description: A URI leading to a COA.
required:
- COA_id
example:
confidence: High
source: string
relationship: string
COA_id: string
example:
- confidence: High
source: string
relationship: string
COA_id: string
description: Identifies or characterizes relationships to one or more related courses of action.
structured_coa_type:
type: string
enum:
- openc2
example: openc2
open_c2_coa:
type: object
properties:
type:
type: string
enum:
- structured_coa
example: structured_coa
id:
type: string
example: string
description: String with at most 1024 characters.
action:
type: object
properties:
type:
type: string
enum:
- alert
- allow
- augment
- contain
- delete
- deny
- detonate
- distill
- get
- investigate
- locate
- mitigate
- modify
- move
- notify
- other
- pause
- query
- redirect
- remediate
- report
- response
- restart
- restore
- resume
- save
- scan
- set
- snapshot
- start
- stop
- substitute
- sync
- throttle
- update
example: alert
required:
- type
example:
type: alert
target:
type: object
properties:
type:
type: string
example: acudid
specifiers:
type: string
example: string
description: Observable types that can be acted upon.
required:
- type
example:
type: acudid
specifiers: string
actuator:
type: object
properties:
type:
type: string
enum:
- endpoint
- endpoint.digital-telephone-handset
- endpoint.laptop
- endpoint.pos-terminal
- endpoint.printer
- endpoint.sensor
- endpoint.server
- endpoint.smart-meter
- endpoint.smart-phone
- endpoint.tablet
- endpoint.workstation
- network
- network.bridge
- network.firewall
- network.gateway
- network.guard
- network.hips
- network.hub
- network.ids
- network.ips
- network.modem
- network.nic
- network.proxy
- network.router
- network.security_manager
- network.sense_making
- network.sensor
- network.switch
- network.vpn
- network.wap
- other
- process
- process.aaa-server
- process.anti-virus-scanner
- process.connection-scanner
- process.directory-service
- process.dns-server
- process.email-service
- process.file-scanner
- process.location-service
- process.network-scanner
- process.remediation-service
- process.reputation-service
- process.sandbox
- process.virtualization-service
- process.vulnerability-scanner
example: endpoint
specifiers:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: List of additional properties describing the actuator.
required:
- type
example:
type: endpoint
specifiers:
- string
modifiers:
type: object
properties:
delay:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
duration:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
frequency:
type: string
example: string
description: String with at most 1024 characters.
id:
type: string
example: string
description: String with at most 1024 characters.
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
response:
type: string
enum:
- acknowledge
- command-ref
- query
- status
example: acknowledge
source:
type: string
example: string
description: String with at most 1024 characters.
destination:
type: string
enum:
- copy-to
- modify-to
- move-to
- report-to
- restore-point
- save-to
- set-to
example: copy-to
method:
type: array
items:
type: string
enum:
- acl
- authenticated
- blackhole
- blacklist
- graceful
- hibernate
- honeypot
- immediate
- segmentation
- spawn
- suspend
- unauthenticated
- whitelist
example: acl
example:
- acl
search:
type: string
enum:
- cve
- patch
- signature
- vendor_bulletin
example: cve
location:
type: string
enum:
- internal
- perimeter
example: internal
option:
type: string
example: string
description: String with at most 1024 characters.
additional_properties:
type: object
properties:
context:
type: string
example: string
description: String with at most 1024 characters.
required:
- context
example:
context: string
example:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
required:
- type
- action
example:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: Schema for submitting new COAs
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: a list of `NewCOA`s.
feedbacks:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- feedback
example: feedback
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
entity_id:
type: string
example: string
description: A URI leading to an entity.
feedback:
type: integer
enum:
- -1
- 0
- 1
example: -1
reason:
type: string
example: string
required:
- entity_id
- feedback
- reason
example:
feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new Feedback.
uniqueItems: true
example:
- feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewFeedback`s.
incidents:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- incident
example: incident
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'Represents the level of certainty or trustworthiness associated with the incident. It denotes the reliability of the intelligence associated with the incident.
The `confidence` field can take on several values, including:
- `info`: Indicates that the incident information is based on sources with no previous track record or there is no track record for the source reporting the incident.
- `low`: Indicates that the incident information is based on sources with a questionable track record or there is limited information about the accuracy of the source.
- `medium`: Indicates that the incident information is based on sources with a mixed track record or of uncertain reliability.
- `high`: Indicates that the incident information is based on sources with a proven track record and high degree of reliability.
The `confidence` field can be used to indicate the level of trust and confidence that can be attributed to the incident, and it may impact how the incident is prioritized, analyzed and addressed. It can also help in the decision-making process associated with the incident response activities.
It is important to note that the `confidence` field is subjective and can be interpreted differently by different organizations or analysts. As such, it is often used in conjunction with other intelligence attributes, such as the `severity` field, to provide a more complete picture of the incident.'
status:
type: string
enum:
- Closed
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Closed: Merged'
- 'Closed: Near-Miss'
- 'Closed: Other'
- 'Closed: Suspected'
- 'Closed: Under Review'
- Containment Achieved
- Hold
- 'Hold: External'
- 'Hold: Internal'
- 'Hold: Legal'
- Incident Reported
- New
- 'New: Presented'
- 'New: Processing'
- Open
- 'Open: Contained'
- 'Open: Investigating'
- 'Open: Recovered'
- 'Open: Reported'
- Rejected
- Restoration Achieved
- Stalled
example: Closed
description: The `status` field represents the current state of an incident within the incident management process. Its values help in tracking and reporting the progress of the incident from its discovery to its resolution.
incident_time:
type: object
properties:
opened:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first opened.
discovered:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first discovered.
reported:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first reported.
remediated:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the remediation of the damage from the incident was completed.
closed:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was last closed.
rejected:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was first rejected.
contained:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was first contained.
required:
- opened
example:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
description: Relevant time values associated with this Incident.
meta:
type: object
additionalProperties:
type: string
example: string
x-anyOf:
- type: string
example: string
- type: number
format: double
example: 10.0
- type: string
format: date-time
example: '2016-01-01T01:01:01Z'
- type: string
example: keyword
- type: boolean
example: true
example:
keyword: string
description: metadata associated to the incident.
properties: {}
scores:
type: object
additionalProperties:
type: number
format: double
example: 10.0
description: A non-negative score number.
example:
asset: 10.0
description: Used to indicate the severity or impact score of the threat represented by the incident.
properties: {}
categories:
type: array
items:
type: string
example: Attrition
example:
- Attrition
description: A set of categories for this incident.
discovery_method:
type: string
example: Agent Disclosure
description: Identifies how the incident was discovered.
intended_effect:
type: string
example: Account Takeover
description: Specifies the suspected intended effect of this incident
assignees:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: A set of owners assigned to this incident.
detection_sources:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: A set of sources that contributed threat detections to the incident.
promotion_method:
type: string
enum:
- Automated
- Manual
example: Automated
description: Describes method for promoting an Incident, whether manually or automatically. An Incident may be created manually by a SOAR analyst or SOC operator, or through an automated correlation or aggregation rule or engine that matches a specific set of events or alerts, and promotes them to Incident(s).
detection_status:
type: string
enum:
- active
- inactive_expired
- inactive_merged
- inactive_oversized
- inactive_user_closed
example: active
description: Represents the state of an incident within the incident generation process, indicating whether the incident is actively receiving updates or is no longer being updated.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
description: "Represents the potential impact of an incident on an organization's security posture and business operations. It helps organizations prioritize and allocate resources for incident response based on the severity level of the incident \nIt helps analysts and incident handlers prioritize incidents by indicating the level of risk and potential impact associated with the incident. This enables organizations to allocate resources efficiently and address the most critical incidents first.\nCan also be used to generate reports and metrics for measuring the effectiveness of the incident response process and to identify trends and patterns in the threat landscape.\nIt is important to note that the `severity` field is subjective and can be interpreted differently by different organizations or analysts. Therefore, it should be used in conjunction with other intelligence attributes, such as the `confidence` field, to provide a more comprehensive view of the incident."
tactics:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Represents the offensive techniques, approaches, or procedures that an adversary may use to achieve their objectives during an attack. It helps in understanding the intent and capabilities of the adversary and can be used to identify indicators of attack (IoAs) or indicators of compromise (IoCs) that are associated with the adversary's tactics.
techniques:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Represents the specific methods or actions used by an attacker to carry out an offensive maneuver or achieve their goals.
short_id:
type: string
example: string
description: A human-readable, short identifier for the incident, unique within an organization.
required:
- confidence
- status
- incident_time
example:
description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
description: For submitting a new Incident.
uniqueItems: true
example:
- description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
description: a list of `NewIncident`s.
indicators:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- indicator
example: indicator
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which this Indicator is considered valid.
producer:
type: string
example: string
description: String with at most 1024 characters.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
negate:
type: boolean
example: true
description: Specifies the absence of the pattern.
indicator_type:
type: array
items:
type: string
enum:
- Anonymization
- C2
- Compromised PKI Certificate
- Domain Watchlist
- Exfiltration
- File Hash Watchlist
- Host Characteristics
- IMEI Watchlist
- IMSI Watchlist
- IP Watchlist
- Login Name
- Malicious E-mail
- Malware Artifacts
- Private Threat Feed
- URL Watchlist
example: Anonymization
example:
- Anonymization
description: Specifies the type or types for this Indicator.
tags:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Descriptors for this indicator.
composite_indicator_expression:
type: object
properties:
operator:
type: string
enum:
- and
- not
- or
example: and
indicator_ids:
type: array
items:
type: string
example: string
description: A URI leading to an indicator.
example:
- string
required:
- operator
- indicator_ids
example:
operator: and
indicator_ids:
- string
likely_impact:
type: string
example: string
description: Likely potential impact within the relevant context if this Indicator were to occur.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: level of confidence held in the accuracy of this Indicator.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: Relevant kill chain phases indicated by this Indicator.
test_mechanisms:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
specification:
type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
x-anyOf:
- type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
- type: object
properties:
type:
type: string
enum:
- ThreatBrain
example: ThreatBrain
query:
type: string
example: string
variables:
type: array
items:
type: string
example: string
example:
- string
required:
- type
- variables
example:
type: ThreatBrain
query: string
variables:
- string
description: An indicator which runs in threatbrain...
- type: object
properties:
type:
type: string
enum:
- Snort
example: Snort
snort_sig:
type: string
example: string
required:
- type
- snort_sig
example:
type: Snort
snort_sig: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- SIOC
example: SIOC
SIOC:
type: string
example: string
required:
- type
- SIOC
example:
type: SIOC
SIOC: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- OpenIOC
example: OpenIOC
open_IOC:
type: string
example: string
required:
- type
- open_IOC
example:
type: OpenIOC
open_IOC: string
description: An indicator which contains an XML blob of an openIOC indicator.
required:
- producer
example:
description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: For submitting a new Indicator
uniqueItems: true
example:
- description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: a list of `NewIndicator`s.
judgements:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- judgement
example: judgement
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
disposition:
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Matches :disposition_name as in {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}
disposition_name:
type: string
enum:
- Clean
- Common
- Malicious
- Suspicious
- Unknown
example: Clean
description: String verdict identifiers.
priority:
type: integer
format: int64
example: 10
description: A value 0-100 that determine the priority of a judgement. Curated feeds of black/white lists, for example known good products within your organizations, should use a 95. All automated systems should use a priority of 90, or less. Human judgements should have a priority of 100, so that humans can always override machines.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
reason:
type: string
example: string
description: String with at most 1024 characters.
reason_uri:
type: string
example: string
description: A URI
required:
- source
- observable
- priority
- confidence
- severity
example:
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
description: Schema for submitting new Judgements.
uniqueItems: true
example:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
description: a list of `NewJudgement`s.
malwares:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- malware
example: malware
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
labels:
type: array
items:
type: string
example: adware
description: Malware label is an open vocabulary that represents different types and functions of malware. Malware labels are not mutually exclusive; a malware instance can be both spyware and a screen capture tool.
example:
- adware
description: The type of malware being described.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: The list of Kill Chain Phases for which this Malware can be used.
x_mitre_aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Software.aliases.
abstraction_level:
type: string
enum:
- family
- variant
- version
example: family
description: Malware abstraction level.
required:
- title
- description
- short_description
- labels
example:
description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new Malware.
uniqueItems: true
example:
- description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewMalware`s.
notes:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- note
example: note
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
note_class:
type: string
example: keyword
content:
type: string
example: string
description: Markdown string with at most 5000 characters.
related_entities:
type: array
items:
type: object
properties:
entity_type:
type: string
example: string
entity_id:
type: string
example: string
description: A URI leading to an entity.
required:
- entity_type
- entity_id
example:
entity_type: string
entity_id: string
example:
- entity_type: string
entity_id: string
author:
type: string
example: string
required:
- note_class
- content
- related_entities
example:
schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
description: Schema for submitting Notes
uniqueItems: true
example:
- schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
description: a list of `NewNote`s.
relationships:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- relationship
example: relationship
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
relationship_type:
type: string
example: attributed-to
source_ref:
type: string
example: string
description: A URI leading to an entity.
target_ref:
type: string
example: string
description: A URI leading to an entity.
required:
- relationship_type
- source_ref
- target_ref
example:
description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
description: Schema for submitting new Relationships.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
description: a list of `NewRelationship`s.
sightings:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- sighting
example: sighting
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
count:
type: integer
format: int64
example: 10
description: 'The number of times an indicator was observed within a certain period of time.
For example, if an IP address associated with known malicious activity is observed once within a period of time, it may indicate a low-level threat. However, if the same IP address is observed multiple times within a short time frame, it may indicate a more severe and persistent threat.
It can also be used to prioritize security alerts and indicate the urgency of a response. High counts indicate that an indicator is actively being used in a larger campaign, while low counts may indicate isolated incidents.'
internal:
type: boolean
example: false
description: "If `true`, indicates that the sighting was reported from internal sources, such as an organization's own internal security tools or SOC.\n Internal sightings are often considered more reliable and actionable than external sightings, which are reported from external sources and may have a lower level of trustworthiness. Internal sightings can provide more context and can help identify potential threats that are unique to a particular environment or organization.\n Internal sightings can also help organizations prioritize their security response efforts by identifying threats that are specific to their environment and may not yet be widely known."
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
resolution:
type: string
example: detected
description: Represents the disposition or actions taken on the associated threat intelligence.
data:
type: object
properties:
columns:
type: array
items:
type: object
properties:
name:
type: string
example: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
example: integer
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
type: boolean
example: true
description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`.
short_description:
type: string
example: string
required:
- name
- type
example:
name: string
type: integer
description: string
required: true
short_description: string
example:
- name: string
type: integer
description: string
required: true
short_description: string
description: an ordered list of column definitions
rows:
type: array
items:
type: array
items:
example: anything
example:
- - anything
description: an ordered list of rows
row_count:
type: integer
format: int64
example: 10
description: The number of rows in the data table.
required:
- columns
- rows
example:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: An embedded data table for the Sighting.
sensor:
type: string
example: endpoint
description: The OpenC2 Actuator name that best fits the device that is creating this sighting (e.g. network.firewall)
sensor_coordinates:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
os:
type: string
example: string
required:
- type
- observables
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
description: Describes the device that made the sighting (sensor) and contains identifying observables for the sensor.
targets:
type: array
items:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
os:
type: string
example: string
required:
- type
- observables
- observed_time
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
description: Describes the target of the sighting and contains identifying observables for the target.
example:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
description: 'May include one or more targets that observed the associated indicator. Targets can include network devices, host devices, or other entities that are capable of detecting indicators of compromise.
Can be used to assess the scope of potential threats, helping analysts understand which devices or components of the network may be vulnerable to attack. For example, if a particular malware strain is detected on several different systems within an organization, the `targets` field may indicate which systems are affected and which may need to be isolated or patched to prevent further spread.'
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
description: The object(s) of interest.
relations:
type: array
items:
type: object
properties:
origin:
type: string
example: string
origin_uri:
type: string
example: string
description: A URI
relation:
type: string
example: Allocated
relation_info:
type: object
additionalProperties:
example: anything
example:
keyword: anything
properties: {}
source:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
related:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
required:
- origin
- relation
- source
- related
example:
origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
description: A relation inside a Sighting.
example:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
description: Provide any context we can about where the observable came from.
context:
type: object
properties:
process_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- ProcessCreateEvent
example: ProcessCreateEvent
process_args:
type: string
example: string
description: String with at most 2048 characters.
process_hash:
type: string
example: string
description: String with at most 2048 characters.
process_size:
type: integer
format: int64
example: 10
process_disposition:
type: string
example: string
description: String with at most 1024 characters.
parent_creation_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
parent_process_id:
type: integer
format: int64
example: 10
parent_process_guid:
type: integer
format: int64
example: 10
parent_process_name:
type: string
example: string
description: String with at most 1024 characters.
parent_process_args:
type: string
example: string
description: String with at most 2048 characters.
parent_process_username:
type: string
example: string
description: String with at most 1024 characters.
parent_process_hash:
type: string
example: string
description: String with at most 2048 characters.
parent_process_size:
type: integer
format: int64
example: 10
parent_process_disposition:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- type
example:
parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
example:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
description: a list of `ProcessCreate`
library_load_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- LibraryLoadEvent
example: LibraryLoadEvent
dll_library_name:
type: string
example: string
description: String with at most 1024 characters.
dll_library_path:
type: string
example: string
description: String with at most 2048 characters.
required:
- time
- process_id
- process_name
- type
- dll_library_name
- dll_library_path
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
description: a list of `LibraryLoadType`
file_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileCreateEvent
example: FileCreateEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileCreateType`
file_delete_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileDeleteEvent
example: FileDeleteEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileDeleteType`
file_modify_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileModifyEvent
example: FileModifyEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileModifyType`
file_move_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileMoveEvent
example: FileMoveEvent
old_name:
type: string
example: string
description: String with at most 1024 characters.
new_name:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
- old_name
- new_name
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
description: a list of `FileMoveType`
netflow_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- NetflowEvent
example: NetflowEvent
traffic:
type: object
properties:
protocol:
type: integer
format: int64
example: 10
description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
source_ip:
type: string
example: string
destination_ip:
type: string
example: string
source_port:
type: integer
format: int64
example: 10
destination_port:
type: integer
format: int64
example: 10
direction:
type: string
enum:
- incoming
- outgoing
example: incoming
destination_host_name:
type: string
example: string
source_subnet:
type: string
example: string
destination_subnet:
type: string
example: string
required:
- protocol
- source_ip
- destination_ip
- source_port
- destination_port
- direction
example:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
process_path:
type: string
example: string
description: String with at most 1024 characters.
process_args:
type: string
example: string
description: String with at most 1024 characters.
process_hash:
type: string
example: string
description: String with at most 1024 characters.
process_account_type:
type: string
example: string
description: String with at most 1024 characters.
process_account:
type: string
example: string
description: String with at most 1024 characters.
parent_process_id:
type: integer
format: int64
example: 10
parent_process_name:
type: string
example: string
description: String with at most 1024 characters.
parent_process_path:
type: string
example: string
description: String with at most 1024 characters.
parent_process_args:
type: string
example: string
description: String with at most 1024 characters.
parent_process_hash:
type: string
example: string
description: String with at most 1024 characters.
parent_process_account:
type: string
example: string
description: String with at most 1024 characters.
parent_process_account_type:
type: string
example: string
description: String with at most 1024 characters.
flow_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
byte_count_out:
type: integer
format: int64
example: 10
byte_count_in:
type: integer
format: int64
example: 10
required:
- time
- process_id
- process_name
- type
- traffic
example:
parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
example:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
description: a list of `NetflowType`
http_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- HTTPEvent
example: HTTPEvent
host:
type: string
example: string
description: String with at most 1024 characters.
traffic:
type: object
properties:
protocol:
type: integer
format: int64
example: 10
description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
source_ip:
type: string
example: string
destination_ip:
type: string
example: string
source_port:
type: integer
format: int64
example: 10
destination_port:
type: integer
format: int64
example: 10
direction:
type: string
enum:
- incoming
- outgoing
example: incoming
destination_host_name:
type: string
example: string
source_subnet:
type: string
example: string
destination_subnet:
type: string
example: string
required:
- protocol
- source_ip
- destination_ip
- source_port
- destination_port
- direction
example:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
url_port:
type: integer
format: int64
example: 10
query:
type: string
example: string
description: String with at most 5000 characters.
encrypted:
type: boolean
example: true
method:
type: string
enum:
- CONNECT
- GET
- HEAD
- OPTIONS
- PATCH
- POST
- PUT
- TRACE
example: CONNECT
required:
- time
- process_id
- process_name
- type
- host
- traffic
example:
process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
example:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
description: a list of `HTTPType`
registry_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryCreateEvent
example: RegistryCreateEvent
required:
- time
- process_id
- process_name
- registry_key
- type
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
description: a list of `RegistryCreateType`
registry_set_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistrySetEvent
example: RegistrySetEvent
registry_value:
type: string
example: string
description: String with at most 2048 characters.
registry_data_length:
type: integer
format: int64
example: 10
registry_data:
type: string
example: string
description: String with at most 5000 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
- registry_value
example:
process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
example:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
description: a list of `RegistrySetType`
registry_delete_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryDeleteEvent
example: RegistryDeleteEvent
registry_value:
type: string
example: string
description: String with at most 2048 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
description: a list of `RegistryDeleteType`
registry_rename_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryRenameEvent
example: RegistryRenameEvent
registry_old_key:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
- registry_old_key
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
description: a list of `RegistryRenameType`
example:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
description: Context including the event type that best fits the type of the sighting.
activity_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the malicious activity occurred. For example, the time when a malware sample was executing, or the time range of a network intrusion.
detection_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the malicious activity was detected by the source engine or security tool. This may differ from the activity_interval if detection occurred after the activity.
modification_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the sighting record was created or last updated in the system.
required:
- observed_time
example:
description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: For submitting a new Sighting.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: a list of `NewSighting`s.
identity_assertions:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- identity-assertion
example: identity-assertion
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
identity:
type: object
properties:
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
required:
- observables
example:
observables:
- value: 1.2.3.4
type: ip
description: Attributes for which the assertion is being made.
assertions:
type: array
items:
type: object
properties:
name:
type: string
example: cisco:ctr:ad:host_domain_name
description: An open vocabulary containing well known assertion types
value:
type: string
example: string
required:
- name
- value
example:
name: cisco:ctr:ad:host_domain_name
value: string
example:
- name: cisco:ctr:ad:host_domain_name
value: string
description: Any known context about the identity attributes.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- identity
- assertions
example:
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
description: For submitting a new IdentityAssertion.
uniqueItems: true
example:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
description: a list of `NewIdentityAssertion`s.
target_records:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- target-record
example: target-record
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
targets:
type: array
items:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
os:
type: string
example: string
description: Source Operating System where TargetRecord was originated.
internal:
type: boolean
example: false
description: Is it internal to our network?
sensor:
type: string
example: string
description: 'The OpenC2 Actuator name that best fits the device that is creating this TargetRecord (e.g.: network.firewall, etc.)'
source_uri:
type: string
example: string
description: A URI
required:
- type
- observables
- observed_time
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
description: Schema for TargetRecord Targets
example:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
required:
- source
- targets
example:
description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new TargetRecord.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewTargetRecord`s.
tools:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- tool
example: tool
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
labels:
type: array
items:
type: string
example: credential-exploitation
description: Tool labels describe the categories of tools that can be used to perform attacks.
example:
- credential-exploitation
description: The kind(s) of tool(s) being described.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: The list of kill chain phases for which this Tool can be used.
tool_version:
type: string
example: string
description: The version identifier associated with the Tool.
x_mitre_aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Software.aliases.
required:
- title
- description
- short_description
- labels
example:
description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new Tool.
uniqueItems: true
example:
- description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewTool`s.
verdicts:
type: array
items:
type: object
properties:
type:
type: string
enum:
- verdict
example: verdict
disposition:
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Numeric verdict identifiers.
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
disposition_name:
type: string
enum:
- Clean
- Common
- Malicious
- Suspicious
- Unknown
example: Clean
description: 'The disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}'
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- type
- disposition
- observable
- valid_time
example:
type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: "A Verdict is chosen from all of the Judgements on that Observable which have not yet expired. The highest priority Judgement becomes the active verdict. If there is more than one Judgement with that priority, then Clean disposition has priority over all others, then Malicious disposition, and so on down to Unknown.\n\n The ID of a verdict is a a str of the form \"observable.type:observable.value\" for example, \"ip:1.1.1.1\""
uniqueItems: true
example:
- type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: a list of `Verdict`s.
data_tables:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- data-table
example: data-table
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
columns:
type: array
items:
type: object
properties:
name:
type: string
example: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
example: integer
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
type: boolean
example: true
description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`.
short_description:
type: string
example: string
required:
- name
- type
example:
name: string
type: integer
description: string
required: true
short_description: string
example:
- name: string
type: integer
description: string
required: true
short_description: string
description: An ordered list of column definitions.
rows:
type: array
items:
type: array
items:
example: anything
example:
- - anything
description: An ordered list of rows
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
row_count:
type: integer
format: int64
example: 10
description: The number of rows in the data table.
required:
- columns
- rows
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting a NewDataTable record.
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewDataTable`s.
weaknesses:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- weakness
example: weakness
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: Should be short and limited to the key points that define this weakness.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
structure:
type: string
enum:
- Chain
- Composite
- Simple
example: Chain
description: Defines the structural nature of the weakness.
languages:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Language name (Clojure, Java, ...)
class:
type: string
example: Assembly
description: Class of language.
required:
- prevalence
example:
prevalence: Often
name: string
class: Assembly
example:
- prevalence: Often
name: string
class: Assembly
description: Applicable Languages.
operating_systems:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: String with at most 1024 characters.
version:
type: string
example: string
description: String with at most 1024 characters.
cpe_id:
type: string
example: string
description: String with at most 1024 characters.
class:
type: string
example: Android
description: Class of Operating System.
required:
- prevalence
example:
prevalence: Often
name: string
version: string
cpe_id: string
class: Android
example:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
description: Applicable operating systems.
architectures:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Architecture name (ARM, x86, ...)
class:
type: string
example: Embedded
description: Class of architecture
required:
- prevalence
example:
prevalence: Often
name: string
class: Embedded
example:
- prevalence: Often
name: string
class: Embedded
description: Applicable architectures.
paradigms:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Paradigm name (Client Server, Mainframe)
required:
- prevalence
example:
prevalence: Often
name: string
example:
- prevalence: Often
name: string
description: Applicable paradigms.
technologies:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Technology name (Web Server, Web Client)
required:
- prevalence
example:
prevalence: Often
name: string
example:
- prevalence: Often
name: string
description: Applicable technologies.
background_details:
type: string
example: string
description: Information that is relevant but not related to the nature of the weakness itself.
alternate_terms:
type: array
items:
type: object
properties:
term:
type: string
example: string
description: The actual alternate term.
description:
type: string
example: string
description: Provides context for the alternate term by which this weakness may be known.
required:
- term
example:
term: string
description: string
example:
- term: string
description: string
description: Indicates one or more other names used to describe this weakness.
modes_of_introduction:
type: array
items:
type: object
properties:
phase:
type: string
example: Architecture and Design
description: Identifies the point in the software life cycle at which the weakness may be introduced.
note:
type: string
example: string
description: Provides a typical scenario related to introduction during the given phase.
required:
- phase
example:
phase: Architecture and Design
note: string
example:
- phase: Architecture and Design
note: string
description: Information about how and when a given weakness may be introduced.
likelihood:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Likelihood of exploit.
common_consequences:
type: array
items:
type: object
properties:
scopes:
type: array
items:
type: string
example: Access Control
description: Defines the different areas of software security that can be affected by exploiting a weakness.
example:
- Access Control
description: Identifies the security property that is violated.
impacts:
type: array
items:
type: string
example: Alter Execution Logic
example:
- Alter Execution Logic
description: Describes the technical impact that arises if an adversary succeeds in exploiting this weakness.
likelihood:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: How likely the specific consequence is expected to be seen relative to the other consequences.
note:
type: string
example: string
description: Additional commentary about a consequence.
required:
- scopes
example:
scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
example:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
description: Refers to the typical or expected negative effects that can result from exploiting the weakness. This could include anything from unauthorized access to data, denial of service, system crashes or other things.
detection_methods:
type: array
items:
type: object
properties:
method:
type: string
example: Architecture or Design Review
description: Identifies the particular detection method being described.
description:
type: string
example: string
description: Provides some context of how this method can be applied to a specific weakness.
effectiveness:
type: string
example: High
description: How effective the detection method may be in detecting the associated weakness.
effectiveness_notes:
type: string
example: string
description: Provides additional discussion of the strengths and shortcomings of this detection method.
required:
- method
- description
example:
method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
example:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
description: Identifies methods that may be employed to detect this weakness, including their strengths and limitations.
potential_mitigations:
type: array
items:
type: object
properties:
description:
type: string
example: string
description: A description of this individual mitigation including any strengths and shortcomings of this mitigation for the weakness.
phases:
type: array
items:
type: string
example: Architecture and Design
description: Defines the different regularities that guide the applicability of platforms.
example:
- Architecture and Design
description: Indicates the development life cycle phase during which this particular mitigation may be applied.
strategy:
type: string
example: Attack Surface Reduction
description: A general strategy for protecting a system to which this mitigation contributes.
effectiveness:
type: string
example: Defense in Depth
description: Summarizes how effective the mitigation may be in preventing the weakness.
effectiveness_notes:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
- description
example:
description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
example:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
description: Describes potential mitigations associated with a weakness.
functional_areas:
type: array
items:
type: string
example: Authentication
description: Defines the different functional areas of software in which the weakness may appear.
example:
- Authentication
description: Identifies the functional area of the software in which the weakness is most likely to occur.
affected_resources:
type: array
items:
type: string
example: CPU
description: Defines a resource of a system.
example:
- CPU
description: Identifies system resources that can be affected by an exploit of this weakness.
notes:
type: array
items:
type: object
properties:
type:
type: string
example: Applicable Platform
description: Defines the different types of notes that can be associated with a weakness.
note:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
- type
- note
example:
type: Applicable Platform
note: string
example:
- type: Applicable Platform
note: string
description: Provides any additional comments about the weakness.
abstraction_level:
type: string
enum:
- Base
- Class
- Compound
- Variant
example: Base
description: Refers to the level of abstraction or granularity used to describe the weakness. It helps to categorize the vulnerability based on the level of detail provided.
required:
- description
example:
description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
description: For submitting a new weakness.
uniqueItems: true
example:
- description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
description: a list of `NewWeakness`s.
vulnerabilities:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- vulnerability
example: vulnerability
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: "Various sources of vulnerability information can be used, including third-party resources like the National Vulnerability Database (NVD) and the Common Vulnerabilities and Exposures (CVE) database. The platform then analyzes this data and provides the user with relevant details such as the severity of the vulnerability, the affected systems, and remediation recommendations. \n\n Based on this information, the user can prioritize patching and other mitigation strategies to reduce the risk of potential attacks."
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
cve:
type: object
properties:
cve_data_meta:
type: object
properties:
id:
type: string
example: string
description: String with at most 1024 characters.
assigner:
type: string
example: string
description: String with at most 1024 characters.
example:
id: string
assigner: string
required:
- cve_data_meta
example:
cve_data_meta:
id: string
assigner: string
impact:
type: object
properties:
cvss_v2:
type: object
properties:
vector_string:
type: string
example: string
description: a text representation of a set of CVSSv2 metrics. It is commonly used to record or transfer CVSSv2 metric information in a concise form
base_score:
type: number
format: double
example: 10.0
description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v2/guide'
base_severity:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
impact_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
exploitability_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
access_vector:
type: string
enum:
- adjacent network
- local
- network
example: network
description: This metric reflects how the vulnerability is exploited.The more remote an attacker can be to attack a host, the greater the vulnerability score.
access_complexity:
type: string
enum:
- high
- low
- medium
example: low
description: 'This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system. For example, consider a buffer overflow in an Internet service: once the target system is located, the attacker can launch an exploit at will.'
authentication:
type: string
enum:
- multiple
- none
- single
example: none
description: This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. This metric does not gauge the strength or complexity of the authentication process, only that an attacker is required to provide credentials before an exploit may occur. The fewer authentication instances that are required, the higher the vulnerability score.
confidentiality_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact on confidentiality of a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. Increasedconfidentiality impact increases the vulnerability score.
integrity_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information. Increased integrity impact increases the vulnerability score.
availability_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact to availability of a successfully exploited vulnerability. Availability refers to the accessibility of information resources. Attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system. Increased availability impact increases the vulnerability score.
exploitability:
type: string
enum:
- functional
- high
- not_defined
- proof_of_concept
- unproven
example: not_defined
description: This metric measures the current state of exploit techniques or code availability. Public availability of easy-to-use exploit code increases the number of potential attackers by including those who are unskilled thereby increasing the severity of the vulnerability.
remediation_level:
type: string
enum:
- not_defined
- official_fix
- temporary_fix
- unavailable
- workaround
example: not_defined
description: The remediation level of a vulnerability is an important factor for prioritization. The typical vulnerability is unpatched when initially published. Workarounds or hotfixes may offer interim remediation until an official patch or upgrade is issued. Each of these respective stages adjusts the temporal score downwards, reflecting the decreasing urgency as remediation becomes final. The less official and permanent a fix, the higher the vulnerability score is.
report_confidence:
type: string
enum:
- confirmed
- not_defined
- unconfirmed
- uncorroborated
example: not_defined
description: This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details. Sometimes, only the existence of vulnerabilities are publicized, but without specific details. The vulnerability may later be corroborated and then confirmed through acknowledgement by the author or vendor of the affected technology. The urgency of a vulnerability is higher when a vulnerability is known to exist with certainty. This metric also suggests the level of technical knowledge available to would-be attackers. The more a vulnerability is validated by the vendor or other reputable sources, the higher the score.
temporal_vector_string:
type: string
example: string
description: A text representation of a set of CVSSv2 temporal metrics. Temporal metrics allow analysists to calculate threat severity based on temporal factors such as reliability of vulnerability reports, availability of mitigations, and the ease or difficulty of conducting the exploit. It is commonly used to record or transfer CVSSv2 metric information in a concise form
collateral_damage_potential:
type: string
enum:
- high
- low
- low_medium
- medium_high
- none
- not_defined
example: not_defined
description: This metric measures the potential for loss of life or physical assets through damage or theft of property or equipment. The metric may also measure economic loss of productivity or revenue. Naturally, the greater the damage potential, the higher the vulnerability score.
target_distribution:
type: string
enum:
- high
- low
- medium
- none
- not_defined
example: not_defined
description: This metric measures the proportion of vulnerable systems. It is meant as an environment-specific indicator in order to approximate the percentage of systems that could be affected by the vulnerability. The greater the proportion of vulnerable systems, the higher the score.
confidentiality_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
integrity_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
availability_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
environmental_vector_string:
type: string
example: string
description: A text representation of a set of CVSSv2 environmental metrics. Environmental metrics allow analysists to calculate threat scores in relation to environmental security requirements, collateral damage potential, and target availability. It is commonly used to record or transfer CVSSv2 metric information in a concise form
obtain_all_privilege:
type: boolean
example: true
obtain_user_privilege:
type: boolean
example: true
obtain_other_privilege:
type: boolean
example: true
user_interaction_required:
type: boolean
example: true
required:
- vector_string
- base_score
- base_severity
example:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
type: object
properties:
vector_string:
type: string
example: string
description: a text representation of a set of CVSSv3 metrics. It is commonly used to record or transfer CVSSv3 metric information in a concise form
base_score:
type: number
format: double
example: 10.0
description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v3-1'
base_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
impact_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
exploitability_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
attack_vector:
type: string
enum:
- adjacent_network
- local
- network
- physical
example: adjacent_network
description: Reflects the context by which vulnerability exploitation is possible
modified_attack_vector:
type: string
enum:
- adjacent_network
- local
- network
- not_defined
- physical
example: not_defined
description: modified attack vector
attack_complexity:
type: string
enum:
- high
- low
example: high
description: describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability
modified_attack_complexity:
type: string
enum:
- high
- low
- not_defined
example: not_defined
description: modified attack complexity
privileges_required:
type: string
enum:
- high
- low
- none
example: high
description: describes the level of privileges an attacker must possess before successfully exploiting the vulnerability
modified_privileges_required:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified privileges required
user_interaction:
type: string
enum:
- none
- required
example: none
description: captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component
modified_user_interaction:
type: string
enum:
- none
- not_defined
- required
example: none
description: modified user interaction
scope:
type: string
enum:
- changed
- unchanged
example: changed
description: the ability for a vulnerability in one software component to impact resources beyond its means, or privileges
modified_scope:
type: string
enum:
- changed
- not_defined
- unchanged
example: not_defined
description: modified scope
confidentiality_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability
modified_confidentiality_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified confidentiality impact
integrity_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to integrity of a successfully exploited vulnerability
modified_integrity_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified integrity impact
availability_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability
modified_availability_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified availability impact
exploit_code_maturity:
type: string
enum:
- functional
- high
- not_defined
- proof_of_concept
- unproven
example: functional
description: measures the likelihood of the vulnerability being attacked
remediation_level:
type: string
enum:
- high
- not_defined
- offical_fix
- temporary_fix
- unavailable
- workaround
example: high
description: Remediation Level of a vulnerability is an important factor for prioritization
report_confidence:
type: string
enum:
- confirmed
- reasonable
- unknown
example: confirmed
description: measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details
temporal_score:
type: number
format: double
example: 10.0
description: Round up(CVSSv3BaseScore × CVSSv3ExploitCodeMaturity × CVSSv3RemediationLevel × CVSSv3ReportConfidence)
temporal_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
description: temporal severity
availability_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
confidentiality_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
integrity_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
environmental_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
environmental_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
required:
- vector_string
- base_score
- base_severity
example:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
example:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: "Describes the potential impact of a vulnerability that is being tracked in the system. Provides information on the extent of damage that a vulnerability can cause and how serious the consequences could be if it is exploited. \n\nMay contain granular information about the vulnerability severity using the CVSS system, versions 2 and 3.\n\nCVSSv2 and CVSSv3 have different methods of calculating base scores, but both are designed to provide an indication of the level of risk that a vulnerability poses. The base score ranges from 0 to 10, with 10 being the most severe. Additionally, both CVSSv2 and CVSSv3 define severity levels, such as low, medium, high, and critical, based on the base score."
configurations:
type: object
properties:
CVE_data_version:
type: string
example: string
description: Specifies the version of the CVE (Common Vulnerabilities and Exposures) dictionary used by the vulnerability information provider.
nodes:
type: array
items:
type: object
properties:
operator:
type: string
enum:
- AND
- OR
example: AND
description: The operator string influences how seqs of cpe matches are related to one another.
cpe_match:
type: array
items:
type: object
properties:
vulnerable:
type: boolean
example: true
cpe23Uri:
type: string
example: string
description: A text representation of a software or hardware platform.
versionStartIncluding:
type: string
example: string
description: A string representing the lower bound(inclusive) of version in the CPE.
versionEndIncluding:
type: string
example: string
description: A string representing the upper bound(inclusive) of version in the CPE.
versionStartExcluding:
type: string
example: string
description: A string representing the lower bound(exclusive) of version in the CPE.
versionEndExcluding:
type: string
example: string
description: A string representing the upper bound(exclusive) of version in the CPE.
required:
- vulnerable
- cpe23Uri
example:
vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
example:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
type: array
items:
type: object
properties:
operator:
type: string
enum:
- AND
- OR
example: AND
description: The operator string influences how seqs of cpe matches are related to one another.
cpe_match:
type: array
items:
type: object
properties:
vulnerable:
type: boolean
example: true
cpe23Uri:
type: string
example: string
description: A text representation of a software or hardware platform.
versionStartIncluding:
type: string
example: string
description: A string representing the lower bound(inclusive) of version in the CPE.
versionEndIncluding:
type: string
example: string
description: A string representing the upper bound(inclusive) of version in the CPE.
versionStartExcluding:
type: string
example: string
description: A string representing the lower bound(exclusive) of version in the CPE.
versionEndExcluding:
type: string
example: string
description: A string representing the upper bound(exclusive) of version in the CPE.
required:
- vulnerable
- cpe23Uri
example:
vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
example:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate:
type: boolean
example: true
description: Negates operator when true.
required:
- operator
- cpe_match
example:
operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
example:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate:
type: boolean
example: true
description: Negates operator when true.
required:
- operator
example:
operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
example:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
description: Each `node` in the CTIM standard configuration includes information such as the `operator` (such as "less than", or "greater than or equal to"), and the `cpe` (Common Platform Enumeration) string which identifies the specific software, `CPE` is a structured naming scheme for IT systems, platforms, and software packages, and it is instrumental in enabling data exchange between different systems.
required:
- CVE_data_version
- nodes
example:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
description: "Represents a list of affected versions or configurations of a software component that is impacted by a vulnerability. \nBy tracking the affected software components and versions, defenders can identify which systems are potentially exposed to an attack, and apply appropriate mitigations."
published_date:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: "Represents the date when a vulnerability was publicly disclosed or made available to the general public. \n\nImportant for tracking the age of a vulnerability, as well as for determining when a particular vulnerability was first introduced into a system. The published date can be used to identify the time window during which a system may have been vulnerable to a particular exploit.\n\nFor example, if an organization discovers that a vulnerability was published before their system's installation date, but they did not apply the necessary security updates in a timely manner, it can be concluded that their system was vulnerable for the period between the installation date and the date when the necessary security updates were applied."
last_modified_date:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: 'Represents the date when the vulnerability metadata was last updated in the internal database.
It can be used to track the freshness of the vulnerability information. If the `last_modified_date` is more recent than the `published_date`, it can indicate that there has been some new information or updates related to the vulnerability, such as new patch releases or changes in the severity or impact rating.'
required:
- description
example:
description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: For submitting a new vulnerability.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: a list of `NewVulnerability`s.
actor_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_mapping_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_properties_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
attack_pattern_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
campaign_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
coa_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
feedback_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
identity_assertion_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
incident_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
indicator_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
judgement_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
malware_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
note_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
relationship_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
sighting_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
target_record_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
tool_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
verdict_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
data_table_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
weakness_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
vulnerability_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- source
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
asset_mapping_refs:
- string
note_refs:
- string
data_table_refs:
- string
attack_pattern_refs:
- string
sighting_refs:
- string
schema_version: 1.3.30
revision: 10
assets:
- description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
weakness_refs:
- string
tool_refs:
- string
target_record_refs:
- string
asset_refs:
- string
tools:
- description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
indicators:
- description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
attack_patterns:
- description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
type: bundle
weaknesses:
- description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
source: string
external_ids:
- string
feedback_refs:
- string
asset_properties:
- properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
short_description: string
feedbacks:
- feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
judgement_refs:
- string
title: string
coa_refs:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
verdicts:
- type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
campaigns:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
source_uri: string
actors:
- description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
indicator_refs:
- string
actor_refs:
- string
language: string
data_tables:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
id: string
notes:
- schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
identity_assertions:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
judgements:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
malwares:
- description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
target_records:
- description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
asset_mappings:
- asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
relationship_refs:
- string
tlp: green
incidents:
- description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
identity_assertion_refs:
- string
sightings:
- description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
campaign_refs:
- string
vulnerability_refs:
- string
asset_properties_refs:
- string
relationships:
- description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
timestamp: '2016-01-01T01:01:01Z'
verdict_refs:
- string
malware_refs:
- string
incident_refs:
- string
vulnerabilities:
- description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
coas:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: Describes a Bundle of any set of CTIM entities.
investigated_observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
source:
title: InvestigationSource
description: String with at most 1024 characters.
type: string
example: Cisco XDR Automated Question
title:
title: InvestigationTitle
description: String with at most 1024 characters.
type: string
example: Which devices in my org was this sha seen on?
description:
title: InvestigationDescription
description: String with at most 5000 characters.
type: string
example: 'For the following hashes:
- sha256:defg...1234
- sha256:abcd..1234
Determine which devices in my org have instances of the file in the past 30 days'
required:
- bundle
required: true
/v2/investigation/snapshot:
post:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/transit+msgpack:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/transit+json:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/edn:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
tags:
- v2
summary: Create Investigation from Snapshot
security:
- JWT-Bearer: []
- oauth2: []
requestBody:
content:
application/json:
schema:
type: object
additionalProperties:
type: string
x-allOf:
- type: object
additionalProperties:
type: string
- type: object
properties:
short_description:
type: string
description:
type: string
source:
type: string
actions:
type: string
timestamp:
type: string
required:
- short_description
- source
- actions
- timestamp
application/transit+msgpack:
schema:
type: object
additionalProperties:
type: string
x-allOf:
- type: object
additionalProperties:
type: string
- type: object
properties:
short_description:
type: string
description:
type: string
source:
type: string
actions:
type: string
timestamp:
type: string
required:
- short_description
- source
- actions
- timestamp
application/transit+json:
schema:
type: object
additionalProperties:
type: string
x-allOf:
- type: object
additionalProperties:
type: string
- type: object
properties:
short_description:
type: string
description:
type: string
source:
type: string
actions:
type: string
timestamp:
type: string
required:
- short_description
- source
- actions
- timestamp
application/edn:
schema:
type: object
additionalProperties:
type: string
x-allOf:
- type: object
additionalProperties:
type: string
- type: object
properties:
short_description:
type: string
description:
type: string
source:
type: string
actions:
type: string
timestamp:
type: string
required:
- short_description
- source
- actions
- timestamp
required: true
/v2/investigation/{investigation-id}/snapshot:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/transit+msgpack:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/transit+json:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/edn:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: investigation-id
description: ''
required: true
schema:
type: string
tags:
- v2
summary: Create Investigation from Investigation Id
security:
- JWT-Bearer: []
- oauth2: []
/v2/investigation/{investigation-id}/errors:
get:
responses:
default:
description: ''
parameters:
- in: path
name: investigation-id
description: The investigation in scope
required: true
title: InvestigationId
schema:
type: string
format: uuid
default: 61399c06-5ea8-44ae-8256-cfcf4437ca5a
tags:
- v2
summary: Investigation Errors
security:
- JWT-Bearer: []
- oauth2: []
/v2/investigation/{investigation-id}/entities:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: array
items:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
application/transit+msgpack:
schema:
type: array
items:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
application/transit+json:
schema:
type: array
items:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
application/edn:
schema:
type: array
items:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: investigation-id
description: The investigation in scope
required: true
title: InvestigationId
schema:
type: string
format: uuid
default: 61399c06-5ea8-44ae-8256-cfcf4437ca5a
tags:
- v2
summary: Investigation Entities
security:
- JWT-Bearer: []
- oauth2: []
/v2/investigation/{investigation-id}/events:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
events:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
observed_time:
type: object
properties:
start_time:
type: string
end_time:
type:
- string
- 'null'
required:
- start_time
type:
type: string
enum:
- sighting
context: {}
data:
type: object
properties:
columns:
type: array
items:
type: object
properties:
name:
type: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
description:
type:
- string
- 'null'
required:
type: boolean
short_description:
type:
- string
- 'null'
required:
- name
- type
rows:
type: array
items: {}
row_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- columns
- rows
external_ids:
type: array
items:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
internal:
type: boolean
language:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
resolution:
type: string
enum:
- allowed
- blocked
- contained
- detected
sensor:
type: string
sensor_coordinates:
type: object
properties:
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
os:
type: string
type:
type: string
required:
- observables
- type
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_description:
type: string
source:
type: string
source_uri:
type: string
timestamp:
type: string
compacted_entities:
type: array
items:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
compacted_relations:
type: array
items:
type: object
properties:
source:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
related:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
relation:
type: string
origin:
type: string
required:
- source
- related
- relation
uniqueItems: true
title:
type:
- string
- 'null'
tlp:
type: string
enum:
- amber
- green
- red
- white
notability:
type: object
properties:
first_seen_target:
type: object
properties:
label:
type: string
targets:
type: array
items: {}
uniqueItems: true
required:
- label
- targets
severity:
type: object
properties:
label:
type: string
required:
- label
mitre-attack:
type: object
properties:
label:
type: string
required:
- label
first_seen_indicator:
type: object
properties:
label:
type: string
indicators:
type: array
items: {}
uniqueItems: true
required:
- label
- indicators
original_event:
type: object
properties:
label:
type: string
required:
- label
mitreData:
type: array
items:
type: object
properties:
id:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
value:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
phase_name:
type: string
enum:
- privilege-escalation
- exfiltration
- defense-evasion
- initial-access
- collection
- execution
- impact
- reconnaissance
- command-and-control
- lateral-movement
- resource-development
- credential-access
- discovery
- persistence
priority:
type: integer
enum:
- 6
- 12
- 7
- 3
- 10
- 4
- 13
- 1
- 11
- 9
- 2
- 8
- 8
- 5
url:
type: string
enum:
- https://attack.mitre.org/tactics/TA0004/
- https://attack.mitre.org/tactics/TA0010/
- https://attack.mitre.org/tactics/TA0005/
- https://attack.mitre.org/tactics/TA0001/
- https://attack.mitre.org/tactics/TA0009/
- https://attack.mitre.org/tactics/TA0002/
- https://attack.mitre.org/tactics/TA0040/
- https://attack.mitre.org/tactics/TA0043/
- https://attack.mitre.org/tactics/TA0011/
- https://attack.mitre.org/tactics/TA0008/
- https://attack.mitre.org/tactics/TA0042/
- https://attack.mitre.org/tactics/TA0006/
- https://attack.mitre.org/tactics/TA0007/
- https://attack.mitre.org/tactics/TA0003/
title:
type: string
enum:
- Privilege Escalation
- Exfiltration
- Defense Evasion
- Initial Access
- Collection
- Execution
- Impact
- Reconnaissance
- Command and Control
- Lateral Movement
- Resource Development
- Credential Access
- Discovery
- Persistence
required:
- id
- value
- phase_name
- priority
- url
- title
uniqueItems: true
notable:
type: boolean
original:
type: boolean
indicators:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- indicator
example: indicator
description: The fixed value indicator
schema_version:
type: string
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type:
- string
- 'null'
example: string
description: A description of object, which may be detailed.
short_description:
type:
- string
- 'null'
example: string
description: A single line, short summary of the object.
source:
type:
- string
- 'null'
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type:
- string
- 'null'
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which this Indicator is considered valid.
producer:
type: string
example: string
description: String with at most 1024 characters.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
negate:
type: boolean
example: true
description: Specifies the absence of the pattern.
indicator_type:
type: array
items:
type: string
enum:
- Anonymization
- C2
- Compromised PKI Certificate
- Domain Watchlist
- Exfiltration
- File Hash Watchlist
- Host Characteristics
- IMEI Watchlist
- IMSI Watchlist
- IP Watchlist
- Login Name
- Malicious E-mail
- Malware Artifacts
- Private Threat Feed
- URL Watchlist
example: Anonymization
example:
- Anonymization
description: Specifies the type or types for this Indicator.
tags:
type:
- array
- 'null'
items:
type: string
example:
- string
description: Descriptors for this indicator.
composite_indicator_expression:
type: object
properties:
operator:
type: string
enum:
- and
- not
- or
example: and
indicator_ids:
type: array
items:
type: string
example: string
description: A URI leading to an indicator.
example:
- string
required:
- operator
- indicator_ids
example:
operator: and
indicator_ids:
- string
likely_impact:
type: string
example: string
description: Likely potential impact within the relevant context if this Indicator were to occur.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: level of confidence held in the accuracy of this Indicator.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: Relevant kill chain phases indicated by this Indicator.
test_mechanisms:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
specification:
type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
x-anyOf:
- type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
- type: object
properties:
type:
type: string
enum:
- ThreatBrain
example: ThreatBrain
query:
type: string
example: string
variables:
type: array
items:
type: string
example: string
example:
- string
required:
- type
- variables
example:
type: ThreatBrain
query: string
variables:
- string
description: An indicator which runs in threatbrain...
- type: object
properties:
type:
type: string
enum:
- Snort
example: Snort
snort_sig:
type: string
example: string
required:
- type
- snort_sig
example:
type: Snort
snort_sig: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- SIOC
example: SIOC
SIOC:
type: string
example: string
required:
- type
- SIOC
example:
type: SIOC
SIOC: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- OpenIOC
example: OpenIOC
open_IOC:
type: string
example: string
required:
- type
- open_IOC
example:
type: OpenIOC
open_IOC: string
description: An indicator which contains an XML blob of an openIOC indicator.
value:
title: Event.Indicator.Value
type: string
example: W32.AdditionVariableCommandObfuscation.ioc
description: The canonical label for an indicator.
required:
- id
- producer
- value
example:
description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: 'An indicator is a test, or a collection of judgements that define
criteria for identifying the activity, or presence of malware, or
other unwanted software.
We follow the
[STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/)
closely, with the exception of not including observables within the
indicator, and preferring a _specification_ object encoded in JSON as
opposed to an opaque _implementation_ block.
Additional, you will want to either define judgements against
Observables that are linked to this indicator, with the ID in the
_indicators_ field of those Judgements, or you can provide a
_specification_ value.'
investigationId:
type:
- string
- 'null'
investigationShortDescription:
type:
- string
- 'null'
investigationSource:
type:
- string
- 'null'
targets:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
relations:
type: array
items:
type: object
properties:
origin:
type: string
relation:
type: string
related:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
source:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
origin_uri:
type: string
relation_info: {}
required:
- origin
- relation
- related
- source
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
tactics_and_techniques:
type: array
items:
title: Mitre tactics and Techniques
type: object
properties:
id:
title: MitreID
type: string
example: TA0003
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: TA0003
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Persistence
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: Persistence
description:
title: MitreDescription
type: string
example: 'The adversary is trying to maintain their foothold.
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.'
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 44
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/TA0003
description: The source url for this tactic or technique
mitre_type:
type: string
enum:
- tactic
- technique
- subtechnique
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- mitre_type
description: A MITRE object from https://attack.mitre.org/
required:
- confidence
- count
- id
- observed_time
- type
- notable
- original
- targets
- relations
- observables
required:
- events
application/transit+msgpack:
schema:
type: object
properties:
events:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
observed_time:
type: object
properties:
start_time:
type: string
end_time:
type:
- string
- 'null'
required:
- start_time
type:
type: string
enum:
- sighting
context: {}
data:
type: object
properties:
columns:
type: array
items:
type: object
properties:
name:
type: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
description:
type:
- string
- 'null'
required:
type: boolean
short_description:
type:
- string
- 'null'
required:
- name
- type
rows:
type: array
items: {}
row_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- columns
- rows
external_ids:
type: array
items:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
internal:
type: boolean
language:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
resolution:
type: string
enum:
- allowed
- blocked
- contained
- detected
sensor:
type: string
sensor_coordinates:
type: object
properties:
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
os:
type: string
type:
type: string
required:
- observables
- type
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_description:
type: string
source:
type: string
source_uri:
type: string
timestamp:
type: string
compacted_entities:
type: array
items:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
compacted_relations:
type: array
items:
type: object
properties:
source:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
related:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
relation:
type: string
origin:
type: string
required:
- source
- related
- relation
uniqueItems: true
title:
type:
- string
- 'null'
tlp:
type: string
enum:
- amber
- green
- red
- white
notability:
type: object
properties:
first_seen_target:
type: object
properties:
label:
type: string
targets:
type: array
items: {}
uniqueItems: true
required:
- label
- targets
severity:
type: object
properties:
label:
type: string
required:
- label
mitre-attack:
type: object
properties:
label:
type: string
required:
- label
first_seen_indicator:
type: object
properties:
label:
type: string
indicators:
type: array
items: {}
uniqueItems: true
required:
- label
- indicators
original_event:
type: object
properties:
label:
type: string
required:
- label
mitreData:
type: array
items:
type: object
properties:
id:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
value:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
phase_name:
type: string
enum:
- privilege-escalation
- exfiltration
- defense-evasion
- initial-access
- collection
- execution
- impact
- reconnaissance
- command-and-control
- lateral-movement
- resource-development
- credential-access
- discovery
- persistence
priority:
type: integer
enum:
- 6
- 12
- 7
- 3
- 10
- 4
- 13
- 1
- 11
- 9
- 2
- 8
- 8
- 5
url:
type: string
enum:
- https://attack.mitre.org/tactics/TA0004/
- https://attack.mitre.org/tactics/TA0010/
- https://attack.mitre.org/tactics/TA0005/
- https://attack.mitre.org/tactics/TA0001/
- https://attack.mitre.org/tactics/TA0009/
- https://attack.mitre.org/tactics/TA0002/
- https://attack.mitre.org/tactics/TA0040/
- https://attack.mitre.org/tactics/TA0043/
- https://attack.mitre.org/tactics/TA0011/
- https://attack.mitre.org/tactics/TA0008/
- https://attack.mitre.org/tactics/TA0042/
- https://attack.mitre.org/tactics/TA0006/
- https://attack.mitre.org/tactics/TA0007/
- https://attack.mitre.org/tactics/TA0003/
title:
type: string
enum:
- Privilege Escalation
- Exfiltration
- Defense Evasion
- Initial Access
- Collection
- Execution
- Impact
- Reconnaissance
- Command and Control
- Lateral Movement
- Resource Development
- Credential Access
- Discovery
- Persistence
required:
- id
- value
- phase_name
- priority
- url
- title
uniqueItems: true
notable:
type: boolean
original:
type: boolean
indicators:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- indicator
example: indicator
description: The fixed value indicator
schema_version:
type: string
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type:
- string
- 'null'
example: string
description: A description of object, which may be detailed.
short_description:
type:
- string
- 'null'
example: string
description: A single line, short summary of the object.
source:
type:
- string
- 'null'
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type:
- string
- 'null'
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which this Indicator is considered valid.
producer:
type: string
example: string
description: String with at most 1024 characters.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
negate:
type: boolean
example: true
description: Specifies the absence of the pattern.
indicator_type:
type: array
items:
type: string
enum:
- Anonymization
- C2
- Compromised PKI Certificate
- Domain Watchlist
- Exfiltration
- File Hash Watchlist
- Host Characteristics
- IMEI Watchlist
- IMSI Watchlist
- IP Watchlist
- Login Name
- Malicious E-mail
- Malware Artifacts
- Private Threat Feed
- URL Watchlist
example: Anonymization
example:
- Anonymization
description: Specifies the type or types for this Indicator.
tags:
type:
- array
- 'null'
items:
type: string
example:
- string
description: Descriptors for this indicator.
composite_indicator_expression:
type: object
properties:
operator:
type: string
enum:
- and
- not
- or
example: and
indicator_ids:
type: array
items:
type: string
example: string
description: A URI leading to an indicator.
example:
- string
required:
- operator
- indicator_ids
example:
operator: and
indicator_ids:
- string
likely_impact:
type: string
example: string
description: Likely potential impact within the relevant context if this Indicator were to occur.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: level of confidence held in the accuracy of this Indicator.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: Relevant kill chain phases indicated by this Indicator.
test_mechanisms:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
specification:
type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
x-anyOf:
- type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
- type: object
properties:
type:
type: string
enum:
- ThreatBrain
example: ThreatBrain
query:
type: string
example: string
variables:
type: array
items:
type: string
example: string
example:
- string
required:
- type
- variables
example:
type: ThreatBrain
query: string
variables:
- string
description: An indicator which runs in threatbrain...
- type: object
properties:
type:
type: string
enum:
- Snort
example: Snort
snort_sig:
type: string
example: string
required:
- type
- snort_sig
example:
type: Snort
snort_sig: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- SIOC
example: SIOC
SIOC:
type: string
example: string
required:
- type
- SIOC
example:
type: SIOC
SIOC: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- OpenIOC
example: OpenIOC
open_IOC:
type: string
example: string
required:
- type
- open_IOC
example:
type: OpenIOC
open_IOC: string
description: An indicator which contains an XML blob of an openIOC indicator.
value:
title: Event.Indicator.Value
type: string
example: W32.AdditionVariableCommandObfuscation.ioc
description: The canonical label for an indicator.
required:
- id
- producer
- value
example:
description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: 'An indicator is a test, or a collection of judgements that define
criteria for identifying the activity, or presence of malware, or
other unwanted software.
We follow the
[STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/)
closely, with the exception of not including observables within the
indicator, and preferring a _specification_ object encoded in JSON as
opposed to an opaque _implementation_ block.
Additional, you will want to either define judgements against
Observables that are linked to this indicator, with the ID in the
_indicators_ field of those Judgements, or you can provide a
_specification_ value.'
investigationId:
type:
- string
- 'null'
investigationShortDescription:
type:
- string
- 'null'
investigationSource:
type:
- string
- 'null'
targets:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
relations:
type: array
items:
type: object
properties:
origin:
type: string
relation:
type: string
related:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
source:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
origin_uri:
type: string
relation_info: {}
required:
- origin
- relation
- related
- source
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
tactics_and_techniques:
type: array
items:
title: Mitre tactics and Techniques
type: object
properties:
id:
title: MitreID
type: string
example: TA0003
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: TA0003
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Persistence
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: Persistence
description:
title: MitreDescription
type: string
example: 'The adversary is trying to maintain their foothold.
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.'
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 44
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/TA0003
description: The source url for this tactic or technique
mitre_type:
type: string
enum:
- tactic
- technique
- subtechnique
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- mitre_type
description: A MITRE object from https://attack.mitre.org/
required:
- confidence
- count
- id
- observed_time
- type
- notable
- original
- targets
- relations
- observables
required:
- events
application/transit+json:
schema:
type: object
properties:
events:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
observed_time:
type: object
properties:
start_time:
type: string
end_time:
type:
- string
- 'null'
required:
- start_time
type:
type: string
enum:
- sighting
context: {}
data:
type: object
properties:
columns:
type: array
items:
type: object
properties:
name:
type: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
description:
type:
- string
- 'null'
required:
type: boolean
short_description:
type:
- string
- 'null'
required:
- name
- type
rows:
type: array
items: {}
row_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- columns
- rows
external_ids:
type: array
items:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
internal:
type: boolean
language:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
resolution:
type: string
enum:
- allowed
- blocked
- contained
- detected
sensor:
type: string
sensor_coordinates:
type: object
properties:
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
os:
type: string
type:
type: string
required:
- observables
- type
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_description:
type: string
source:
type: string
source_uri:
type: string
timestamp:
type: string
compacted_entities:
type: array
items:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
compacted_relations:
type: array
items:
type: object
properties:
source:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
related:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
relation:
type: string
origin:
type: string
required:
- source
- related
- relation
uniqueItems: true
title:
type:
- string
- 'null'
tlp:
type: string
enum:
- amber
- green
- red
- white
notability:
type: object
properties:
first_seen_target:
type: object
properties:
label:
type: string
targets:
type: array
items: {}
uniqueItems: true
required:
- label
- targets
severity:
type: object
properties:
label:
type: string
required:
- label
mitre-attack:
type: object
properties:
label:
type: string
required:
- label
first_seen_indicator:
type: object
properties:
label:
type: string
indicators:
type: array
items: {}
uniqueItems: true
required:
- label
- indicators
original_event:
type: object
properties:
label:
type: string
required:
- label
mitreData:
type: array
items:
type: object
properties:
id:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
value:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
phase_name:
type: string
enum:
- privilege-escalation
- exfiltration
- defense-evasion
- initial-access
- collection
- execution
- impact
- reconnaissance
- command-and-control
- lateral-movement
- resource-development
- credential-access
- discovery
- persistence
priority:
type: integer
enum:
- 6
- 12
- 7
- 3
- 10
- 4
- 13
- 1
- 11
- 9
- 2
- 8
- 8
- 5
url:
type: string
enum:
- https://attack.mitre.org/tactics/TA0004/
- https://attack.mitre.org/tactics/TA0010/
- https://attack.mitre.org/tactics/TA0005/
- https://attack.mitre.org/tactics/TA0001/
- https://attack.mitre.org/tactics/TA0009/
- https://attack.mitre.org/tactics/TA0002/
- https://attack.mitre.org/tactics/TA0040/
- https://attack.mitre.org/tactics/TA0043/
- https://attack.mitre.org/tactics/TA0011/
- https://attack.mitre.org/tactics/TA0008/
- https://attack.mitre.org/tactics/TA0042/
- https://attack.mitre.org/tactics/TA0006/
- https://attack.mitre.org/tactics/TA0007/
- https://attack.mitre.org/tactics/TA0003/
title:
type: string
enum:
- Privilege Escalation
- Exfiltration
- Defense Evasion
- Initial Access
- Collection
- Execution
- Impact
- Reconnaissance
- Command and Control
- Lateral Movement
- Resource Development
- Credential Access
- Discovery
- Persistence
required:
- id
- value
- phase_name
- priority
- url
- title
uniqueItems: true
notable:
type: boolean
original:
type: boolean
indicators:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- indicator
example: indicator
description: The fixed value indicator
schema_version:
type: string
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type:
- string
- 'null'
example: string
description: A description of object, which may be detailed.
short_description:
type:
- string
- 'null'
example: string
description: A single line, short summary of the object.
source:
type:
- string
- 'null'
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type:
- string
- 'null'
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which this Indicator is considered valid.
producer:
type: string
example: string
description: String with at most 1024 characters.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
negate:
type: boolean
example: true
description: Specifies the absence of the pattern.
indicator_type:
type: array
items:
type: string
enum:
- Anonymization
- C2
- Compromised PKI Certificate
- Domain Watchlist
- Exfiltration
- File Hash Watchlist
- Host Characteristics
- IMEI Watchlist
- IMSI Watchlist
- IP Watchlist
- Login Name
- Malicious E-mail
- Malware Artifacts
- Private Threat Feed
- URL Watchlist
example: Anonymization
example:
- Anonymization
description: Specifies the type or types for this Indicator.
tags:
type:
- array
- 'null'
items:
type: string
example:
- string
description: Descriptors for this indicator.
composite_indicator_expression:
type: object
properties:
operator:
type: string
enum:
- and
- not
- or
example: and
indicator_ids:
type: array
items:
type: string
example: string
description: A URI leading to an indicator.
example:
- string
required:
- operator
- indicator_ids
example:
operator: and
indicator_ids:
- string
likely_impact:
type: string
example: string
description: Likely potential impact within the relevant context if this Indicator were to occur.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: level of confidence held in the accuracy of this Indicator.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: Relevant kill chain phases indicated by this Indicator.
test_mechanisms:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
specification:
type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
x-anyOf:
- type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
- type: object
properties:
type:
type: string
enum:
- ThreatBrain
example: ThreatBrain
query:
type: string
example: string
variables:
type: array
items:
type: string
example: string
example:
- string
required:
- type
- variables
example:
type: ThreatBrain
query: string
variables:
- string
description: An indicator which runs in threatbrain...
- type: object
properties:
type:
type: string
enum:
- Snort
example: Snort
snort_sig:
type: string
example: string
required:
- type
- snort_sig
example:
type: Snort
snort_sig: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- SIOC
example: SIOC
SIOC:
type: string
example: string
required:
- type
- SIOC
example:
type: SIOC
SIOC: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- OpenIOC
example: OpenIOC
open_IOC:
type: string
example: string
required:
- type
- open_IOC
example:
type: OpenIOC
open_IOC: string
description: An indicator which contains an XML blob of an openIOC indicator.
value:
title: Event.Indicator.Value
type: string
example: W32.AdditionVariableCommandObfuscation.ioc
description: The canonical label for an indicator.
required:
- id
- producer
- value
example:
description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: 'An indicator is a test, or a collection of judgements that define
criteria for identifying the activity, or presence of malware, or
other unwanted software.
We follow the
[STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/)
closely, with the exception of not including observables within the
indicator, and preferring a _specification_ object encoded in JSON as
opposed to an opaque _implementation_ block.
Additional, you will want to either define judgements against
Observables that are linked to this indicator, with the ID in the
_indicators_ field of those Judgements, or you can provide a
_specification_ value.'
investigationId:
type:
- string
- 'null'
investigationShortDescription:
type:
- string
- 'null'
investigationSource:
type:
- string
- 'null'
targets:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
relations:
type: array
items:
type: object
properties:
origin:
type: string
relation:
type: string
related:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
source:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
origin_uri:
type: string
relation_info: {}
required:
- origin
- relation
- related
- source
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
tactics_and_techniques:
type: array
items:
title: Mitre tactics and Techniques
type: object
properties:
id:
title: MitreID
type: string
example: TA0003
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: TA0003
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Persistence
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: Persistence
description:
title: MitreDescription
type: string
example: 'The adversary is trying to maintain their foothold.
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.'
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 44
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/TA0003
description: The source url for this tactic or technique
mitre_type:
type: string
enum:
- tactic
- technique
- subtechnique
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- mitre_type
description: A MITRE object from https://attack.mitre.org/
required:
- confidence
- count
- id
- observed_time
- type
- notable
- original
- targets
- relations
- observables
required:
- events
application/edn:
schema:
type: object
properties:
events:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
observed_time:
type: object
properties:
start_time:
type: string
end_time:
type:
- string
- 'null'
required:
- start_time
type:
type: string
enum:
- sighting
context: {}
data:
type: object
properties:
columns:
type: array
items:
type: object
properties:
name:
type: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
description:
type:
- string
- 'null'
required:
type: boolean
short_description:
type:
- string
- 'null'
required:
- name
- type
rows:
type: array
items: {}
row_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- columns
- rows
external_ids:
type: array
items:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
internal:
type: boolean
language:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
resolution:
type: string
enum:
- allowed
- blocked
- contained
- detected
sensor:
type: string
sensor_coordinates:
type: object
properties:
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
os:
type: string
type:
type: string
required:
- observables
- type
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_description:
type: string
source:
type: string
source_uri:
type: string
timestamp:
type: string
compacted_entities:
type: array
items:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
compacted_relations:
type: array
items:
type: object
properties:
source:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
related:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
relation:
type: string
origin:
type: string
required:
- source
- related
- relation
uniqueItems: true
title:
type:
- string
- 'null'
tlp:
type: string
enum:
- amber
- green
- red
- white
notability:
type: object
properties:
first_seen_target:
type: object
properties:
label:
type: string
targets:
type: array
items: {}
uniqueItems: true
required:
- label
- targets
severity:
type: object
properties:
label:
type: string
required:
- label
mitre-attack:
type: object
properties:
label:
type: string
required:
- label
first_seen_indicator:
type: object
properties:
label:
type: string
indicators:
type: array
items: {}
uniqueItems: true
required:
- label
- indicators
original_event:
type: object
properties:
label:
type: string
required:
- label
mitreData:
type: array
items:
type: object
properties:
id:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
value:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
phase_name:
type: string
enum:
- privilege-escalation
- exfiltration
- defense-evasion
- initial-access
- collection
- execution
- impact
- reconnaissance
- command-and-control
- lateral-movement
- resource-development
- credential-access
- discovery
- persistence
priority:
type: integer
enum:
- 6
- 12
- 7
- 3
- 10
- 4
- 13
- 1
- 11
- 9
- 2
- 8
- 8
- 5
url:
type: string
enum:
- https://attack.mitre.org/tactics/TA0004/
- https://attack.mitre.org/tactics/TA0010/
- https://attack.mitre.org/tactics/TA0005/
- https://attack.mitre.org/tactics/TA0001/
- https://attack.mitre.org/tactics/TA0009/
- https://attack.mitre.org/tactics/TA0002/
- https://attack.mitre.org/tactics/TA0040/
- https://attack.mitre.org/tactics/TA0043/
- https://attack.mitre.org/tactics/TA0011/
- https://attack.mitre.org/tactics/TA0008/
- https://attack.mitre.org/tactics/TA0042/
- https://attack.mitre.org/tactics/TA0006/
- https://attack.mitre.org/tactics/TA0007/
- https://attack.mitre.org/tactics/TA0003/
title:
type: string
enum:
- Privilege Escalation
- Exfiltration
- Defense Evasion
- Initial Access
- Collection
- Execution
- Impact
- Reconnaissance
- Command and Control
- Lateral Movement
- Resource Development
- Credential Access
- Discovery
- Persistence
required:
- id
- value
- phase_name
- priority
- url
- title
uniqueItems: true
notable:
type: boolean
original:
type: boolean
indicators:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- indicator
example: indicator
description: The fixed value indicator
schema_version:
type: string
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type:
- string
- 'null'
example: string
description: A description of object, which may be detailed.
short_description:
type:
- string
- 'null'
example: string
description: A single line, short summary of the object.
source:
type:
- string
- 'null'
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type:
- string
- 'null'
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which this Indicator is considered valid.
producer:
type: string
example: string
description: String with at most 1024 characters.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
negate:
type: boolean
example: true
description: Specifies the absence of the pattern.
indicator_type:
type: array
items:
type: string
enum:
- Anonymization
- C2
- Compromised PKI Certificate
- Domain Watchlist
- Exfiltration
- File Hash Watchlist
- Host Characteristics
- IMEI Watchlist
- IMSI Watchlist
- IP Watchlist
- Login Name
- Malicious E-mail
- Malware Artifacts
- Private Threat Feed
- URL Watchlist
example: Anonymization
example:
- Anonymization
description: Specifies the type or types for this Indicator.
tags:
type:
- array
- 'null'
items:
type: string
example:
- string
description: Descriptors for this indicator.
composite_indicator_expression:
type: object
properties:
operator:
type: string
enum:
- and
- not
- or
example: and
indicator_ids:
type: array
items:
type: string
example: string
description: A URI leading to an indicator.
example:
- string
required:
- operator
- indicator_ids
example:
operator: and
indicator_ids:
- string
likely_impact:
type: string
example: string
description: Likely potential impact within the relevant context if this Indicator were to occur.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: level of confidence held in the accuracy of this Indicator.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: Relevant kill chain phases indicated by this Indicator.
test_mechanisms:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
specification:
type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
x-anyOf:
- type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
- type: object
properties:
type:
type: string
enum:
- ThreatBrain
example: ThreatBrain
query:
type: string
example: string
variables:
type: array
items:
type: string
example: string
example:
- string
required:
- type
- variables
example:
type: ThreatBrain
query: string
variables:
- string
description: An indicator which runs in threatbrain...
- type: object
properties:
type:
type: string
enum:
- Snort
example: Snort
snort_sig:
type: string
example: string
required:
- type
- snort_sig
example:
type: Snort
snort_sig: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- SIOC
example: SIOC
SIOC:
type: string
example: string
required:
- type
- SIOC
example:
type: SIOC
SIOC: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- OpenIOC
example: OpenIOC
open_IOC:
type: string
example: string
required:
- type
- open_IOC
example:
type: OpenIOC
open_IOC: string
description: An indicator which contains an XML blob of an openIOC indicator.
value:
title: Event.Indicator.Value
type: string
example: W32.AdditionVariableCommandObfuscation.ioc
description: The canonical label for an indicator.
required:
- id
- producer
- value
example:
description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: 'An indicator is a test, or a collection of judgements that define
criteria for identifying the activity, or presence of malware, or
other unwanted software.
We follow the
[STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/)
closely, with the exception of not including observables within the
indicator, and preferring a _specification_ object encoded in JSON as
opposed to an opaque _implementation_ block.
Additional, you will want to either define judgements against
Observables that are linked to this indicator, with the ID in the
_indicators_ field of those Judgements, or you can provide a
_specification_ value.'
investigationId:
type:
- string
- 'null'
investigationShortDescription:
type:
- string
- 'null'
investigationSource:
type:
- string
- 'null'
targets:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
relations:
type: array
items:
type: object
properties:
origin:
type: string
relation:
type: string
related:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
source:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
origin_uri:
type: string
relation_info: {}
required:
- origin
- relation
- related
- source
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
tactics_and_techniques:
type: array
items:
title: Mitre tactics and Techniques
type: object
properties:
id:
title: MitreID
type: string
example: TA0003
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: TA0003
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Persistence
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: Persistence
description:
title: MitreDescription
type: string
example: 'The adversary is trying to maintain their foothold.
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.'
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 44
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/TA0003
description: The source url for this tactic or technique
mitre_type:
type: string
enum:
- tactic
- technique
- subtechnique
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- mitre_type
description: A MITRE object from https://attack.mitre.org/
required:
- confidence
- count
- id
- observed_time
- type
- notable
- original
- targets
- relations
- observables
required:
- events
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: investigation-id
description: The investigation in scope
required: true
title: InvestigationId
schema:
type: string
format: uuid
default: 61399c06-5ea8-44ae-8256-cfcf4437ca5a
- description: A integer greater than 0.
name: limit
title: PositiveInteger
example: 2
required: false
in: query
schema:
type: integer
format: int64
minimum: 0
- description: A integer greater than 0.
name: offset
title: PositiveInteger
example: 2
required: false
in: query
schema:
type: integer
format: int64
minimum: 0
- in: query
name: sort
description: ''
required: false
allowEmptyValue: true
schema:
type: string
enum:
- asc
- desc
- in: query
name: order
description: ''
required: false
allowEmptyValue: true
schema:
type: string
enum:
- start_time
- time
- title
- severity
- source
- in: query
name: important_only
description: Include only important events
required: false
schema:
type: boolean
- in: query
name: notable
description: ''
required: false
schema:
type: boolean
- in: query
name: source
description: ''
required: false
x-anyOf:
- type: array
items:
type: string
- type: string
allowEmptyValue: true
schema:
type: array
items:
type: string
- in: query
name: severity
description: ''
required: false
x-anyOf:
- type: array
items:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
- type: string
allowEmptyValue: true
schema:
type: array
items:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
- in: query
name: type
description: ''
required: false
x-anyOf:
- type: array
items:
type: string
enum:
- Original
- Investigated
- type: string
allowEmptyValue: true
schema:
type: array
items:
type: string
enum:
- Original
- Investigated
- in: query
name: search_text
description: ''
required: false
schema:
type: string
tags:
- v2
summary: Investigation Events
security:
- JWT-Bearer: []
- oauth2: []
/v2/investigation/{investigation-id}/verdicts:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: array
items:
type: object
properties:
type:
type: string
observable:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
end_time:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
- {}
required:
- start_time
- end_time
disposition:
type: integer
format: int64
judgement_ids:
type:
- array
- 'null'
items:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
module:
type: string
module_instance_id:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
module_type_id:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
required:
- type
- observable
- valid_time
- disposition
- judgement_ids
- module
- module_instance_id
- module_type_id
application/transit+msgpack:
schema:
type: array
items:
type: object
properties:
type:
type: string
observable:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
end_time:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
- {}
required:
- start_time
- end_time
disposition:
type: integer
format: int64
judgement_ids:
type:
- array
- 'null'
items:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
module:
type: string
module_instance_id:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
module_type_id:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
required:
- type
- observable
- valid_time
- disposition
- judgement_ids
- module
- module_instance_id
- module_type_id
application/transit+json:
schema:
type: array
items:
type: object
properties:
type:
type: string
observable:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
end_time:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
- {}
required:
- start_time
- end_time
disposition:
type: integer
format: int64
judgement_ids:
type:
- array
- 'null'
items:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
module:
type: string
module_instance_id:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
module_type_id:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
required:
- type
- observable
- valid_time
- disposition
- judgement_ids
- module
- module_instance_id
- module_type_id
application/edn:
schema:
type: array
items:
type: object
properties:
type:
type: string
observable:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
end_time:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
- {}
required:
- start_time
- end_time
disposition:
type: integer
format: int64
judgement_ids:
type:
- array
- 'null'
items:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
module:
type: string
module_instance_id:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
module_type_id:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
required:
- type
- observable
- valid_time
- disposition
- judgement_ids
- module
- module_instance_id
- module_type_id
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: investigation-id
description: The investigation in scope
required: true
title: InvestigationId
schema:
type: string
format: uuid
default: 61399c06-5ea8-44ae-8256-cfcf4437ca5a
tags:
- v2
summary: Investigation Verdicts
security:
- JWT-Bearer: []
- oauth2: []
/v2/investigation/{investigation-id}/graph:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
nodes:
type: object
additionalProperties:
type: object
properties:
data:
type: object
properties:
type:
type: string
value:
type: string
asset_id:
type: string
disposition:
type: integer
format: int64
indicators:
type: array
items:
type: string
uniqueItems: true
internal:
type: boolean
incoming-edges:
type: array
items:
type: object
properties:
id:
type: string
value:
type: string
required:
- id
- value
uniqueItems: true
outgoing-edges:
type: array
items:
type: object
properties:
id:
type: string
value:
type: string
required:
- id
- value
uniqueItems: true
investigated:
type: boolean
is_asset:
type: boolean
observableType:
type: string
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
disposition:
type: integer
format: int64
investigated:
type: boolean
required:
- type
- value
- disposition
- investigated
properties:
type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
uniqueItems: true
- type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
modules:
type: array
items:
type: string
uniqueItems: true
sightings:
type: array
items:
type: string
uniqueItems: true
sources:
type: array
items:
type: string
uniqueItems: true
title:
type: string
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
required:
- type
- value
- indicators
- internal
- incoming-edges
- outgoing-edges
- investigated
- is_asset
- observableType
- observables
- modules
- sightings
- sources
- title
times:
type: array
items:
type: object
properties:
time:
type: integer
format: int64
required:
- time
uniqueItems: true
required:
- data
- times
edges:
type: object
additionalProperties:
type: object
properties:
id1:
type: string
id2:
type: string
times:
type: array
items:
type: object
properties:
time:
type: integer
format: int64
required:
- time
uniqueItems: true
data:
type: object
properties:
observed_times:
type: array
items:
type: string
uniqueItems: true
value:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
relation_info: {}
required:
- value
- sightings
required:
- id1
- id2
- times
- data
errors:
type: array
items:
type: object
properties:
type:
type: string
enum:
- E_DATA_TOO_LARGE
message:
type: string
required:
- type
- message
required:
- nodes
- edges
application/transit+msgpack:
schema:
type: object
properties:
nodes:
type: object
additionalProperties:
type: object
properties:
data:
type: object
properties:
type:
type: string
value:
type: string
asset_id:
type: string
disposition:
type: integer
format: int64
indicators:
type: array
items:
type: string
uniqueItems: true
internal:
type: boolean
incoming-edges:
type: array
items:
type: object
properties:
id:
type: string
value:
type: string
required:
- id
- value
uniqueItems: true
outgoing-edges:
type: array
items:
type: object
properties:
id:
type: string
value:
type: string
required:
- id
- value
uniqueItems: true
investigated:
type: boolean
is_asset:
type: boolean
observableType:
type: string
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
disposition:
type: integer
format: int64
investigated:
type: boolean
required:
- type
- value
- disposition
- investigated
properties:
type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
uniqueItems: true
- type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
modules:
type: array
items:
type: string
uniqueItems: true
sightings:
type: array
items:
type: string
uniqueItems: true
sources:
type: array
items:
type: string
uniqueItems: true
title:
type: string
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
required:
- type
- value
- indicators
- internal
- incoming-edges
- outgoing-edges
- investigated
- is_asset
- observableType
- observables
- modules
- sightings
- sources
- title
times:
type: array
items:
type: object
properties:
time:
type: integer
format: int64
required:
- time
uniqueItems: true
required:
- data
- times
edges:
type: object
additionalProperties:
type: object
properties:
id1:
type: string
id2:
type: string
times:
type: array
items:
type: object
properties:
time:
type: integer
format: int64
required:
- time
uniqueItems: true
data:
type: object
properties:
observed_times:
type: array
items:
type: string
uniqueItems: true
value:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
relation_info: {}
required:
- value
- sightings
required:
- id1
- id2
- times
- data
errors:
type: array
items:
type: object
properties:
type:
type: string
enum:
- E_DATA_TOO_LARGE
message:
type: string
required:
- type
- message
required:
- nodes
- edges
application/transit+json:
schema:
type: object
properties:
nodes:
type: object
additionalProperties:
type: object
properties:
data:
type: object
properties:
type:
type: string
value:
type: string
asset_id:
type: string
disposition:
type: integer
format: int64
indicators:
type: array
items:
type: string
uniqueItems: true
internal:
type: boolean
incoming-edges:
type: array
items:
type: object
properties:
id:
type: string
value:
type: string
required:
- id
- value
uniqueItems: true
outgoing-edges:
type: array
items:
type: object
properties:
id:
type: string
value:
type: string
required:
- id
- value
uniqueItems: true
investigated:
type: boolean
is_asset:
type: boolean
observableType:
type: string
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
disposition:
type: integer
format: int64
investigated:
type: boolean
required:
- type
- value
- disposition
- investigated
properties:
type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
uniqueItems: true
- type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
modules:
type: array
items:
type: string
uniqueItems: true
sightings:
type: array
items:
type: string
uniqueItems: true
sources:
type: array
items:
type: string
uniqueItems: true
title:
type: string
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
required:
- type
- value
- indicators
- internal
- incoming-edges
- outgoing-edges
- investigated
- is_asset
- observableType
- observables
- modules
- sightings
- sources
- title
times:
type: array
items:
type: object
properties:
time:
type: integer
format: int64
required:
- time
uniqueItems: true
required:
- data
- times
edges:
type: object
additionalProperties:
type: object
properties:
id1:
type: string
id2:
type: string
times:
type: array
items:
type: object
properties:
time:
type: integer
format: int64
required:
- time
uniqueItems: true
data:
type: object
properties:
observed_times:
type: array
items:
type: string
uniqueItems: true
value:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
relation_info: {}
required:
- value
- sightings
required:
- id1
- id2
- times
- data
errors:
type: array
items:
type: object
properties:
type:
type: string
enum:
- E_DATA_TOO_LARGE
message:
type: string
required:
- type
- message
required:
- nodes
- edges
application/edn:
schema:
type: object
properties:
nodes:
type: object
additionalProperties:
type: object
properties:
data:
type: object
properties:
type:
type: string
value:
type: string
asset_id:
type: string
disposition:
type: integer
format: int64
indicators:
type: array
items:
type: string
uniqueItems: true
internal:
type: boolean
incoming-edges:
type: array
items:
type: object
properties:
id:
type: string
value:
type: string
required:
- id
- value
uniqueItems: true
outgoing-edges:
type: array
items:
type: object
properties:
id:
type: string
value:
type: string
required:
- id
- value
uniqueItems: true
investigated:
type: boolean
is_asset:
type: boolean
observableType:
type: string
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
disposition:
type: integer
format: int64
investigated:
type: boolean
required:
- type
- value
- disposition
- investigated
properties:
type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
uniqueItems: true
- type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
modules:
type: array
items:
type: string
uniqueItems: true
sightings:
type: array
items:
type: string
uniqueItems: true
sources:
type: array
items:
type: string
uniqueItems: true
title:
type: string
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
required:
- type
- value
- indicators
- internal
- incoming-edges
- outgoing-edges
- investigated
- is_asset
- observableType
- observables
- modules
- sightings
- sources
- title
times:
type: array
items:
type: object
properties:
time:
type: integer
format: int64
required:
- time
uniqueItems: true
required:
- data
- times
edges:
type: object
additionalProperties:
type: object
properties:
id1:
type: string
id2:
type: string
times:
type: array
items:
type: object
properties:
time:
type: integer
format: int64
required:
- time
uniqueItems: true
data:
type: object
properties:
observed_times:
type: array
items:
type: string
uniqueItems: true
value:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
relation_info: {}
required:
- value
- sightings
required:
- id1
- id2
- times
- data
errors:
type: array
items:
type: object
properties:
type:
type: string
enum:
- E_DATA_TOO_LARGE
message:
type: string
required:
- type
- message
required:
- nodes
- edges
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: investigation-id
description: The investigation in scope
required: true
title: InvestigationId
schema:
type: string
format: uuid
default: 61399c06-5ea8-44ae-8256-cfcf4437ca5a
tags:
- v2
summary: Investigation Relation Graph
security:
- JWT-Bearer: []
- oauth2: []
/v2/investigation/{investigation-id}/indicators:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: array
items:
type: object
properties:
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
producer:
type: string
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
internal:
type: boolean
source:
type:
- string
- 'null'
source_uri:
type:
- string
- 'null'
sources:
type: array
items:
type: string
tags:
type:
- array
- 'null'
items:
type: string
title:
type:
- string
- 'null'
value:
type: string
required:
- id
- producer
- description
- short_description
- internal
- source
- source_uri
- sources
- tags
- title
- value
application/transit+msgpack:
schema:
type: array
items:
type: object
properties:
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
producer:
type: string
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
internal:
type: boolean
source:
type:
- string
- 'null'
source_uri:
type:
- string
- 'null'
sources:
type: array
items:
type: string
tags:
type:
- array
- 'null'
items:
type: string
title:
type:
- string
- 'null'
value:
type: string
required:
- id
- producer
- description
- short_description
- internal
- source
- source_uri
- sources
- tags
- title
- value
application/transit+json:
schema:
type: array
items:
type: object
properties:
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
producer:
type: string
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
internal:
type: boolean
source:
type:
- string
- 'null'
source_uri:
type:
- string
- 'null'
sources:
type: array
items:
type: string
tags:
type:
- array
- 'null'
items:
type: string
title:
type:
- string
- 'null'
value:
type: string
required:
- id
- producer
- description
- short_description
- internal
- source
- source_uri
- sources
- tags
- title
- value
application/edn:
schema:
type: array
items:
type: object
properties:
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
producer:
type: string
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
internal:
type: boolean
source:
type:
- string
- 'null'
source_uri:
type:
- string
- 'null'
sources:
type: array
items:
type: string
tags:
type:
- array
- 'null'
items:
type: string
title:
type:
- string
- 'null'
value:
type: string
required:
- id
- producer
- description
- short_description
- internal
- source
- source_uri
- sources
- tags
- title
- value
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: investigation-id
description: The investigation in scope
required: true
title: InvestigationId
schema:
type: string
format: uuid
default: 61399c06-5ea8-44ae-8256-cfcf4437ca5a
tags:
- v2
summary: Returns a list of indicators attached to this investigation
security:
- JWT-Bearer: []
- oauth2: []
/v2/investigation/{investigation-id}/observables:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- count
application/transit+msgpack:
schema:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- count
application/transit+json:
schema:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- count
application/edn:
schema:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- count
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: investigation-id
description: The investigation in scope
required: true
title: InvestigationId
schema:
type: string
format: uuid
default: 61399c06-5ea8-44ae-8256-cfcf4437ca5a
tags:
- v2
summary: Returns a list of observables attached to this investigation
security:
- JWT-Bearer: []
- oauth2: []
/v2/investigation/{investigation-id}/overview:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
id:
type: string
format: uuid
created_at:
type: string
format: date-time
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
saved:
type: boolean
saved_at:
type:
- string
- 'null'
format: date-time
investigated_observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
title:
type: string
required:
- id
- created_at
- description
- short_description
- saved
- saved_at
- investigated_observables
- title
application/transit+msgpack:
schema:
type: object
properties:
id:
type: string
format: uuid
created_at:
type: string
format: date-time
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
saved:
type: boolean
saved_at:
type:
- string
- 'null'
format: date-time
investigated_observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
title:
type: string
required:
- id
- created_at
- description
- short_description
- saved
- saved_at
- investigated_observables
- title
application/transit+json:
schema:
type: object
properties:
id:
type: string
format: uuid
created_at:
type: string
format: date-time
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
saved:
type: boolean
saved_at:
type:
- string
- 'null'
format: date-time
investigated_observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
title:
type: string
required:
- id
- created_at
- description
- short_description
- saved
- saved_at
- investigated_observables
- title
application/edn:
schema:
type: object
properties:
id:
type: string
format: uuid
created_at:
type: string
format: date-time
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
saved:
type: boolean
saved_at:
type:
- string
- 'null'
format: date-time
investigated_observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
title:
type: string
required:
- id
- created_at
- description
- short_description
- saved
- saved_at
- investigated_observables
- title
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: investigation-id
description: The investigation in scope
required: true
title: InvestigationId
schema:
type: string
format: uuid
default: 61399c06-5ea8-44ae-8256-cfcf4437ca5a
tags:
- v2
summary: Returns metadata about the investigation
security:
- JWT-Bearer: []
- oauth2: []
/v2/investigation/{investigation-id}/status:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
title: Investigation.Status
description: Details about Investigation Processing.
type: object
properties:
investigation_id:
title: Investigation.Status.InvestigationId
description: The ID of this investigation
type: string
format: uuid
example: d384c7c9-36b8-4781-b8a4-e7b0fe2ff0f3
completed:
title: PositiveInteger
description: A integer greater than 0.
type: integer
format: int64
minimum: 0
example: 1
pending:
title: PositiveInteger
description: A integer greater than 0.
type: integer
format: int64
minimum: 0
example: 0
sightings:
title: PositiveInteger
description: A integer greater than 0.
type: integer
format: int64
minimum: 0
example: 1
indicators:
title: PositiveInteger
description: A integer greater than 0.
type: integer
format: int64
minimum: 0
example: 2
verdicts:
title: PositiveInteger
description: A integer greater than 0.
type: integer
format: int64
minimum: 0
example: 10
required:
- investigation_id
- completed
- pending
- sightings
- indicators
- verdicts
application/transit+msgpack:
schema:
title: Investigation.Status
description: Details about Investigation Processing.
type: object
properties:
investigation_id:
title: Investigation.Status.InvestigationId
description: The ID of this investigation
type: string
format: uuid
example: d384c7c9-36b8-4781-b8a4-e7b0fe2ff0f3
completed:
title: PositiveInteger
description: A integer greater than 0.
type: integer
format: int64
minimum: 0
example: 1
pending:
title: PositiveInteger
description: A integer greater than 0.
type: integer
format: int64
minimum: 0
example: 0
sightings:
title: PositiveInteger
description: A integer greater than 0.
type: integer
format: int64
minimum: 0
example: 1
indicators:
title: PositiveInteger
description: A integer greater than 0.
type: integer
format: int64
minimum: 0
example: 2
verdicts:
title: PositiveInteger
description: A integer greater than 0.
type: integer
format: int64
minimum: 0
example: 10
required:
- investigation_id
- completed
- pending
- sightings
- indicators
- verdicts
application/transit+json:
schema:
title: Investigation.Status
description: Details about Investigation Processing.
type: object
properties:
investigation_id:
title: Investigation.Status.InvestigationId
description: The ID of this investigation
type: string
format: uuid
example: d384c7c9-36b8-4781-b8a4-e7b0fe2ff0f3
completed:
title: PositiveInteger
description: A integer greater than 0.
type: integer
format: int64
minimum: 0
example: 1
pending:
title: PositiveInteger
description: A integer greater than 0.
type: integer
format: int64
minimum: 0
example: 0
sightings:
title: PositiveInteger
description: A integer greater than 0.
type: integer
format: int64
minimum: 0
example: 1
indicators:
title: PositiveInteger
description: A integer greater than 0.
type: integer
format: int64
minimum: 0
example: 2
verdicts:
title: PositiveInteger
description: A integer greater than 0.
type: integer
format: int64
minimum: 0
example: 10
required:
- investigation_id
- completed
- pending
- sightings
- indicators
- verdicts
application/edn:
schema:
title: Investigation.Status
description: Details about Investigation Processing.
type: object
properties:
investigation_id:
title: Investigation.Status.InvestigationId
description: The ID of this investigation
type: string
format: uuid
example: d384c7c9-36b8-4781-b8a4-e7b0fe2ff0f3
completed:
title: PositiveInteger
description: A integer greater than 0.
type: integer
format: int64
minimum: 0
example: 1
pending:
title: PositiveInteger
description: A integer greater than 0.
type: integer
format: int64
minimum: 0
example: 0
sightings:
title: PositiveInteger
description: A integer greater than 0.
type: integer
format: int64
minimum: 0
example: 1
indicators:
title: PositiveInteger
description: A integer greater than 0.
type: integer
format: int64
minimum: 0
example: 2
verdicts:
title: PositiveInteger
description: A integer greater than 0.
type: integer
format: int64
minimum: 0
example: 10
required:
- investigation_id
- completed
- pending
- sightings
- indicators
- verdicts
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: investigation-id
description: The investigation in scope
required: true
title: InvestigationId
schema:
type: string
format: uuid
default: 61399c06-5ea8-44ae-8256-cfcf4437ca5a
tags:
- v2
summary: Investigation Status
security:
- JWT-Bearer: []
- oauth2: []
/v2/investigation/{investigation-id}/summary:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
event_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
last_seen_event:
type:
- string
- 'null'
format: date-time
first_seen_event:
type:
- string
- 'null'
format: date-time
sources:
type: array
items:
type: string
indicators:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
producer:
type: string
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
internal:
type: boolean
source:
type:
- string
- 'null'
source_uri:
type:
- string
- 'null'
sources:
type: array
items:
type: string
tags:
type:
- array
- 'null'
items:
type: string
title:
type:
- string
- 'null'
value:
type: string
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- id
- producer
- description
- short_description
- internal
- source
- source_uri
- sources
- tags
- title
- value
- count
required:
- total_count
- data
observables:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- count
required:
- total_count
- data
targets:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
- count
required:
- total_count
- data
investigation:
type: object
properties:
id:
type: string
created_at:
type: string
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
saved:
type: boolean
saved_at:
type:
- string
- 'null'
investigated_observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
title:
type: string
required:
- id
- created_at
- description
- short_description
- saved
- saved_at
- investigated_observables
- title
required:
- event_count
- last_seen_event
- first_seen_event
- sources
- indicators
- observables
- targets
- investigation
application/transit+msgpack:
schema:
type: object
properties:
event_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
last_seen_event:
type:
- string
- 'null'
format: date-time
first_seen_event:
type:
- string
- 'null'
format: date-time
sources:
type: array
items:
type: string
indicators:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
producer:
type: string
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
internal:
type: boolean
source:
type:
- string
- 'null'
source_uri:
type:
- string
- 'null'
sources:
type: array
items:
type: string
tags:
type:
- array
- 'null'
items:
type: string
title:
type:
- string
- 'null'
value:
type: string
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- id
- producer
- description
- short_description
- internal
- source
- source_uri
- sources
- tags
- title
- value
- count
required:
- total_count
- data
observables:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- count
required:
- total_count
- data
targets:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
- count
required:
- total_count
- data
investigation:
type: object
properties:
id:
type: string
created_at:
type: string
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
saved:
type: boolean
saved_at:
type:
- string
- 'null'
investigated_observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
title:
type: string
required:
- id
- created_at
- description
- short_description
- saved
- saved_at
- investigated_observables
- title
required:
- event_count
- last_seen_event
- first_seen_event
- sources
- indicators
- observables
- targets
- investigation
application/transit+json:
schema:
type: object
properties:
event_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
last_seen_event:
type:
- string
- 'null'
format: date-time
first_seen_event:
type:
- string
- 'null'
format: date-time
sources:
type: array
items:
type: string
indicators:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
producer:
type: string
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
internal:
type: boolean
source:
type:
- string
- 'null'
source_uri:
type:
- string
- 'null'
sources:
type: array
items:
type: string
tags:
type:
- array
- 'null'
items:
type: string
title:
type:
- string
- 'null'
value:
type: string
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- id
- producer
- description
- short_description
- internal
- source
- source_uri
- sources
- tags
- title
- value
- count
required:
- total_count
- data
observables:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- count
required:
- total_count
- data
targets:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
- count
required:
- total_count
- data
investigation:
type: object
properties:
id:
type: string
created_at:
type: string
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
saved:
type: boolean
saved_at:
type:
- string
- 'null'
investigated_observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
title:
type: string
required:
- id
- created_at
- description
- short_description
- saved
- saved_at
- investigated_observables
- title
required:
- event_count
- last_seen_event
- first_seen_event
- sources
- indicators
- observables
- targets
- investigation
application/edn:
schema:
type: object
properties:
event_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
last_seen_event:
type:
- string
- 'null'
format: date-time
first_seen_event:
type:
- string
- 'null'
format: date-time
sources:
type: array
items:
type: string
indicators:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
producer:
type: string
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
internal:
type: boolean
source:
type:
- string
- 'null'
source_uri:
type:
- string
- 'null'
sources:
type: array
items:
type: string
tags:
type:
- array
- 'null'
items:
type: string
title:
type:
- string
- 'null'
value:
type: string
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- id
- producer
- description
- short_description
- internal
- source
- source_uri
- sources
- tags
- title
- value
- count
required:
- total_count
- data
observables:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- count
required:
- total_count
- data
targets:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
- count
required:
- total_count
- data
investigation:
type: object
properties:
id:
type: string
created_at:
type: string
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
saved:
type: boolean
saved_at:
type:
- string
- 'null'
investigated_observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
title:
type: string
required:
- id
- created_at
- description
- short_description
- saved
- saved_at
- investigated_observables
- title
required:
- event_count
- last_seen_event
- first_seen_event
- sources
- indicators
- observables
- targets
- investigation
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: investigation-id
description: The investigation in scope
required: true
title: InvestigationId
schema:
type: string
format: uuid
default: 61399c06-5ea8-44ae-8256-cfcf4437ca5a
tags:
- v2
summary: Returns a Summary of the Investigation
security:
- JWT-Bearer: []
- oauth2: []
/v2/investigation/{investigation-id}/targets:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
- count
application/transit+msgpack:
schema:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
- count
application/transit+json:
schema:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
- count
application/edn:
schema:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
- count
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: investigation-id
description: The investigation in scope
required: true
title: InvestigationId
schema:
type: string
format: uuid
default: 61399c06-5ea8-44ae-8256-cfcf4437ca5a
tags:
- v2
summary: Returns a list of targets attached to this investigation
security:
- JWT-Bearer: []
- oauth2: []
/v2/investigation/{investigation-id}/bundle:
post:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
created_threat_object_counts:
type: object
properties:
sightings:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
indicators:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
verdicts:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
judgements:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
malwares:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
tools:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
attack_patterns:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
assets:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- sightings
- indicators
- verdicts
- judgements
- malwares
- tools
- attack_patterns
- assets
required:
- investigation_id
- created_threat_object_counts
application/transit+msgpack:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
created_threat_object_counts:
type: object
properties:
sightings:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
indicators:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
verdicts:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
judgements:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
malwares:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
tools:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
attack_patterns:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
assets:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- sightings
- indicators
- verdicts
- judgements
- malwares
- tools
- attack_patterns
- assets
required:
- investigation_id
- created_threat_object_counts
application/transit+json:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
created_threat_object_counts:
type: object
properties:
sightings:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
indicators:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
verdicts:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
judgements:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
malwares:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
tools:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
attack_patterns:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
assets:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- sightings
- indicators
- verdicts
- judgements
- malwares
- tools
- attack_patterns
- assets
required:
- investigation_id
- created_threat_object_counts
application/edn:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
created_threat_object_counts:
type: object
properties:
sightings:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
indicators:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
verdicts:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
judgements:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
malwares:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
tools:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
attack_patterns:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
assets:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- sightings
- indicators
- verdicts
- judgements
- malwares
- tools
- attack_patterns
- assets
required:
- investigation_id
- created_threat_object_counts
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: investigation-id
description: The investigation in scope
required: true
title: InvestigationId
schema:
type: string
format: uuid
default: 61399c06-5ea8-44ae-8256-cfcf4437ca5a
tags:
- v2
summary: Add Threat context to an investigation
security:
- JWT-Bearer: []
- oauth2: []
requestBody:
content:
application/json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- bundle
example: bundle
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
actors:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- actor
example: actor
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Indicates the time span for which the information about the Actor is relevant, and after which it could become outdated.
actor_types:
type: array
items:
type: string
example: Cyber Espionage Operations
example:
- Cyber Espionage Operations
identity:
type: object
properties:
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
related_identities:
type: array
items:
type: object
properties:
identity:
type: string
example: string
description: The reference (URI) of the related Identity object.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Specifies the level of confidence in the assertion of the relationship between the two objects.
information_source:
type: string
example: string
description: Specifies the source of the information about the relationship between the two components.
relationship:
type: string
example: string
required:
- identity
example:
identity: string
confidence: High
information_source: string
relationship: string
description: Describes a related Identity
example:
- identity: string
confidence: High
information_source: string
relationship: string
description: Identifies other entity Identities related to this Identity.
required:
- description
- related_identities
example:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
description: Can contain information such as the name of the attacker, the group or organization they belong to, or any other identifier that can help in the attribution process.
motivation:
type: string
example: Ego
description: The reason or purpose behind the malicious activity attributed to this Actor. By understanding a threat actor's motivation, analysts can better predict the attacker's behavior and anticipate future malicious actions.
sophistication:
type: string
enum:
- Aspirant
- Expert
- Innovator
- Novice
- Practitioner
example: Aspirant
description: "Represents the level of expertise and skill that the threat actor has displayed in their malicious activities. Can help security analysts assess the potential impact of an attacker's TTPs and determine the potential attack surface. \n\nFor example, a threat actor with a low sophistication level may primarily rely on off-the-shelf malware and attack tools, while an attacker with high sophistication may use custom tools with advanced evasion techniques, zero-day exploits, and sophisticated methods for command and control of their malware. \n\nThe sophistication level of an attacker can also be inferred based on several factors such as the complexity of attacks, the attacker's knowledge of the targeted organization's systems, and the attacker's ability to remain undetected.\n\nIf an attacker shows a high level of sophistication in reconnaissances, social engineering, and phishing, then the attacker may have a good knowledge of the targeted organization and its employees. This means that the attacker may be more successful in infiltrating the organization's network and compromising its systems."
intended_effect:
type: string
example: Account Takeover
description: "Represents the desired outcome or impact the threat actor is trying to achieve through their malicious activities. \n\n Helps security analysts to understand the attacker's goals beyond the immediate impact of the attack. By understanding the intended effect, analysts can draw connections between seemingly unrelated attacks and build a more complete understanding of an attacker's long-term goals and motivations."
planning_and_operational_support:
type: string
example: string
description: "Provides information about the resources and capabilities of the attacker that could be used to assist in planning and operations related to the threat.\n\n It can be used to describe Infrastructure, Tools, Techniques, and Capabilities used by the threat actor."
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'This field can help analysts decide how much trust they can put in the information provided by the threat intelligence sources.
For example, an Actor entity can have high confidence if the organization''s security researchers have been tracking it for a long time and have gathered a significant amount of intelligence about it through various sources, such as analysis of malware, network traffic, and human intelligence. In contrast, low confidence may indicate the organization has only seen limited or circumstantial evidence.'
aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: A list of other names that this Threat Actor is believed to use.
required:
- source
- title
- description
- short_description
example:
description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
description: Schema for submitting new Actors
uniqueItems: true
example:
- description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
description: a list of `NewActor`s.
assets:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset
example: asset
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: 'Specifies the time range during which the asset is considered valid or accurate.
For example, if an asset entity represents a device, the `valid_time` field could be used to indicate the period during which the device''s configuration information is deemed accurate.'
asset_type:
type: string
enum:
- application
- data
- device
- network
- person
example: application
description: 'Type of the Asset: Device, Person, Application, etc.'
required:
- source
- valid_time
- asset_type
example:
description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new Assets
uniqueItems: true
example:
- description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAsset`s.
asset_mappings:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset-mapping
example: asset-mapping
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: For each asset, we allow for the assertion of time bound properties.This gives us both a record of the current state of the asset,as well as history.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'Level of confidence held in the characterization of this AssetMapping e.g.: is it susceptible to manipulation or translation?'
specificity:
type: string
enum:
- Low
- Medium
- Unique
example: Low
description: Denotes the level of how many assets potentially could have this same identifier.
stability:
type: string
enum:
- Managed
- Physical
- Temporary
example: Managed
description: Do we manage when it changes, or is it always a time bound assignment?
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: An AssetMapping is a record that a specific Observable maps to an Asset for an indicated period of time.
asset_ref:
type: string
example: string
description: URI that points to the mapped Asset.
asset_type:
type: string
enum:
- application
- data
- device
- network
- person
example: application
description: 'Type of the mapped Asset: Device, Person, Application, etc.'
required:
- source
- valid_time
- confidence
- specificity
- stability
- observable
- asset_ref
- asset_type
example:
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
description: Schema for submitting new AssetMapping.
uniqueItems: true
example:
- asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
description: a list of `NewAssetMapping`s.
asset_properties:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset-properties
example: asset-properties
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which the AssetProperties is considered valid.
asset_ref:
type: string
example: string
description: URI that points to the associated Asset.
properties:
type: array
items:
type: object
properties:
name:
type: string
example: string
description: The properties are an open vocabulary.
value:
type: string
example: string
required:
- name
- value
example:
name: string
value: string
example:
- name: string
value: string
required:
- source
- valid_time
- asset_ref
example:
properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new AssetProperties
uniqueItems: true
example:
- properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAssetProperties`s.
attack_patterns:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- attack-pattern
example: attack-pattern
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: A kill chain is a series of steps that an attacker must go through to successfully achieve their objective. The concept was originally developed by the military, but has been adapted to the cybersecurity field to describe the steps an attacker goes through to compromise a target system and achieve their goal.
x_mitre_data_sources:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Data Sources.
x_mitre_platforms:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Platforms.
x_mitre_contributors:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Contributors.
abstraction_level:
type: string
enum:
- aggregate
- category
- detailed
- meta
- standard
example: aggregate
description: The CAPEC abstraction level for patterns describing techniques to attack a system.
required:
- title
- description
- short_description
example:
description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new AttackPattern
uniqueItems: true
example:
- description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAttackPattern`s.
campaigns:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- campaign
example: campaign
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Timestamp for the definition of a specific version of a campaign.
campaign_type:
type: string
example: string
description: 'String value that describes the type of campaign. For example, a campaign type could be ''Ransomware'', ''Advanced Persistent Threat'', ''Business Email Compromise'', ''Phishing'', etc. '
names:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Used to capture alternate names or aliases associated with the campaign. A cyberattack campaign may have multiple names or aliases depending on the group or actor(s) behind the attack, e.g., 'Wannacry' is also known as 'WannaCrypt', 'WCry', 'Wanna Decryptor', etc.
intended_effect:
type: array
items:
type: string
example: Account Takeover
example:
- Account Takeover
description: Characterizes the intended effect of this cyber threat campaign.
status:
type: string
enum:
- Future
- Historic
- Ongoing
example: Future
description: "Indicates current Status of the Campaign. \n\nCan have one of the following values: \n\n- Ongoing: Indicates that the campaign is currently active and ongoing. For example, a mass phishing campaign that is actively targeting users is considered 'ongoing'.\n\n- Historic: Campaign has already occurred and is now in the past.\n\n- Future: This indicates that a campaign is planned or expected to occur in the future. For example, a threat actor may announce their intention to launch a specific cyberattack campaign at a future date."
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Level of confidence held in the characterization of this Campaign.
activity:
type: array
items:
type: object
properties:
date_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Specifies the date and time at which the activity occured.
description:
type: string
example: string
description: A description of the activity.
required:
- date_time
- description
example:
date_time: '2016-01-01T01:01:01Z'
description: string
description: Captures the specific activities or tactics associated with the entity. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc.
example:
- date_time: '2016-01-01T01:01:01Z'
description: string
description: 'Used to capture specific activities or tactics associated with the campaign.
The ''activity'' field is an array of objects, and each element represents a specific activity and time associated with the campaign. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc. By capturing these activities analysts can identify the specific tactics used by the threat actor(s) behind the campaign.'
required:
- title
- description
- short_description
- campaign_type
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
description: Schema for submitting new Campaigns
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
description: a list of `NewCampaign`s.
coas:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- coa
example: coa
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
stage:
type: string
enum:
- Containment
- Eradication
- Identification
- Lessons Learned
- Preparation
- Recovery
- Remedy
- Response
example: Containment
description: Specifies what stage in the cyber threat management lifecycle this Course Of Action is relevant to.
coa_type:
type: string
enum:
- Diplomatic Actions
- Eradication
- Hardening
- Internal Blocking
- Logical Access Restrictions
- Monitoring
- Other
- Patching
- Perimeter Blocking
- Phase
- Physical Access Restrictions
- Playbook
- Policy Actions
- Public Disclosure
- Rebuilding
- Redirection
- Redirection (Honey Pot)
- Task
- Training
example: Diplomatic Actions
description: The type of this COA
objective:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Characterizes the objective to provide guidance on how to mitigate a security incident that has been identified.
impact:
type: string
example: string
description: Characterizes the estimated impact of applying this course of action.
cost:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Characterizes the estimated cost for applying this course of action.
efficacy:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Effectiveness of this course of action in achieving its targeted objective.
related_COAs:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
COA_id:
type: string
example: string
description: A URI leading to a COA.
required:
- COA_id
example:
confidence: High
source: string
relationship: string
COA_id: string
example:
- confidence: High
source: string
relationship: string
COA_id: string
description: Identifies or characterizes relationships to one or more related courses of action.
structured_coa_type:
type: string
enum:
- openc2
example: openc2
open_c2_coa:
type: object
properties:
type:
type: string
enum:
- structured_coa
example: structured_coa
id:
type: string
example: string
description: String with at most 1024 characters.
action:
type: object
properties:
type:
type: string
enum:
- alert
- allow
- augment
- contain
- delete
- deny
- detonate
- distill
- get
- investigate
- locate
- mitigate
- modify
- move
- notify
- other
- pause
- query
- redirect
- remediate
- report
- response
- restart
- restore
- resume
- save
- scan
- set
- snapshot
- start
- stop
- substitute
- sync
- throttle
- update
example: alert
required:
- type
example:
type: alert
target:
type: object
properties:
type:
type: string
example: acudid
specifiers:
type: string
example: string
description: Observable types that can be acted upon.
required:
- type
example:
type: acudid
specifiers: string
actuator:
type: object
properties:
type:
type: string
enum:
- endpoint
- endpoint.digital-telephone-handset
- endpoint.laptop
- endpoint.pos-terminal
- endpoint.printer
- endpoint.sensor
- endpoint.server
- endpoint.smart-meter
- endpoint.smart-phone
- endpoint.tablet
- endpoint.workstation
- network
- network.bridge
- network.firewall
- network.gateway
- network.guard
- network.hips
- network.hub
- network.ids
- network.ips
- network.modem
- network.nic
- network.proxy
- network.router
- network.security_manager
- network.sense_making
- network.sensor
- network.switch
- network.vpn
- network.wap
- other
- process
- process.aaa-server
- process.anti-virus-scanner
- process.connection-scanner
- process.directory-service
- process.dns-server
- process.email-service
- process.file-scanner
- process.location-service
- process.network-scanner
- process.remediation-service
- process.reputation-service
- process.sandbox
- process.virtualization-service
- process.vulnerability-scanner
example: endpoint
specifiers:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: List of additional properties describing the actuator.
required:
- type
example:
type: endpoint
specifiers:
- string
modifiers:
type: object
properties:
delay:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
duration:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
frequency:
type: string
example: string
description: String with at most 1024 characters.
id:
type: string
example: string
description: String with at most 1024 characters.
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
response:
type: string
enum:
- acknowledge
- command-ref
- query
- status
example: acknowledge
source:
type: string
example: string
description: String with at most 1024 characters.
destination:
type: string
enum:
- copy-to
- modify-to
- move-to
- report-to
- restore-point
- save-to
- set-to
example: copy-to
method:
type: array
items:
type: string
enum:
- acl
- authenticated
- blackhole
- blacklist
- graceful
- hibernate
- honeypot
- immediate
- segmentation
- spawn
- suspend
- unauthenticated
- whitelist
example: acl
example:
- acl
search:
type: string
enum:
- cve
- patch
- signature
- vendor_bulletin
example: cve
location:
type: string
enum:
- internal
- perimeter
example: internal
option:
type: string
example: string
description: String with at most 1024 characters.
additional_properties:
type: object
properties:
context:
type: string
example: string
description: String with at most 1024 characters.
required:
- context
example:
context: string
example:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
required:
- type
- action
example:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: Schema for submitting new COAs
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: a list of `NewCOA`s.
feedbacks:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- feedback
example: feedback
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
entity_id:
type: string
example: string
description: A URI leading to an entity.
feedback:
type: integer
enum:
- -1
- 0
- 1
example: -1
reason:
type: string
example: string
required:
- entity_id
- feedback
- reason
example:
feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new Feedback.
uniqueItems: true
example:
- feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewFeedback`s.
incidents:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- incident
example: incident
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'Represents the level of certainty or trustworthiness associated with the incident. It denotes the reliability of the intelligence associated with the incident.
The `confidence` field can take on several values, including:
- `info`: Indicates that the incident information is based on sources with no previous track record or there is no track record for the source reporting the incident.
- `low`: Indicates that the incident information is based on sources with a questionable track record or there is limited information about the accuracy of the source.
- `medium`: Indicates that the incident information is based on sources with a mixed track record or of uncertain reliability.
- `high`: Indicates that the incident information is based on sources with a proven track record and high degree of reliability.
The `confidence` field can be used to indicate the level of trust and confidence that can be attributed to the incident, and it may impact how the incident is prioritized, analyzed and addressed. It can also help in the decision-making process associated with the incident response activities.
It is important to note that the `confidence` field is subjective and can be interpreted differently by different organizations or analysts. As such, it is often used in conjunction with other intelligence attributes, such as the `severity` field, to provide a more complete picture of the incident.'
status:
type: string
enum:
- Closed
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Closed: Merged'
- 'Closed: Near-Miss'
- 'Closed: Other'
- 'Closed: Suspected'
- 'Closed: Under Review'
- Containment Achieved
- Hold
- 'Hold: External'
- 'Hold: Internal'
- 'Hold: Legal'
- Incident Reported
- New
- 'New: Presented'
- 'New: Processing'
- Open
- 'Open: Contained'
- 'Open: Investigating'
- 'Open: Recovered'
- 'Open: Reported'
- Rejected
- Restoration Achieved
- Stalled
example: Closed
description: The `status` field represents the current state of an incident within the incident management process. Its values help in tracking and reporting the progress of the incident from its discovery to its resolution.
incident_time:
type: object
properties:
opened:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first opened.
discovered:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first discovered.
reported:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first reported.
remediated:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the remediation of the damage from the incident was completed.
closed:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was last closed.
rejected:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was first rejected.
contained:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was first contained.
required:
- opened
example:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
description: Relevant time values associated with this Incident.
meta:
type: object
additionalProperties:
type: string
example: string
x-anyOf:
- type: string
example: string
- type: number
format: double
example: 10.0
- type: string
format: date-time
example: '2016-01-01T01:01:01Z'
- type: string
example: keyword
- type: boolean
example: true
example:
keyword: string
description: metadata associated to the incident.
properties: {}
scores:
type: object
additionalProperties:
type: number
format: double
example: 10.0
description: A non-negative score number.
example:
asset: 10.0
description: Used to indicate the severity or impact score of the threat represented by the incident.
properties: {}
categories:
type: array
items:
type: string
example: Attrition
example:
- Attrition
description: A set of categories for this incident.
discovery_method:
type: string
example: Agent Disclosure
description: Identifies how the incident was discovered.
intended_effect:
type: string
example: Account Takeover
description: Specifies the suspected intended effect of this incident
assignees:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: A set of owners assigned to this incident.
detection_sources:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: A set of sources that contributed threat detections to the incident.
promotion_method:
type: string
enum:
- Automated
- Manual
example: Automated
description: Describes method for promoting an Incident, whether manually or automatically. An Incident may be created manually by a SOAR analyst or SOC operator, or through an automated correlation or aggregation rule or engine that matches a specific set of events or alerts, and promotes them to Incident(s).
detection_status:
type: string
enum:
- active
- inactive_expired
- inactive_merged
- inactive_oversized
- inactive_user_closed
example: active
description: Represents the state of an incident within the incident generation process, indicating whether the incident is actively receiving updates or is no longer being updated.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
description: "Represents the potential impact of an incident on an organization's security posture and business operations. It helps organizations prioritize and allocate resources for incident response based on the severity level of the incident \nIt helps analysts and incident handlers prioritize incidents by indicating the level of risk and potential impact associated with the incident. This enables organizations to allocate resources efficiently and address the most critical incidents first.\nCan also be used to generate reports and metrics for measuring the effectiveness of the incident response process and to identify trends and patterns in the threat landscape.\nIt is important to note that the `severity` field is subjective and can be interpreted differently by different organizations or analysts. Therefore, it should be used in conjunction with other intelligence attributes, such as the `confidence` field, to provide a more comprehensive view of the incident."
tactics:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Represents the offensive techniques, approaches, or procedures that an adversary may use to achieve their objectives during an attack. It helps in understanding the intent and capabilities of the adversary and can be used to identify indicators of attack (IoAs) or indicators of compromise (IoCs) that are associated with the adversary's tactics.
techniques:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Represents the specific methods or actions used by an attacker to carry out an offensive maneuver or achieve their goals.
short_id:
type: string
example: string
description: A human-readable, short identifier for the incident, unique within an organization.
required:
- confidence
- status
- incident_time
example:
description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
description: For submitting a new Incident.
uniqueItems: true
example:
- description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
description: a list of `NewIncident`s.
indicators:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- indicator
example: indicator
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which this Indicator is considered valid.
producer:
type: string
example: string
description: String with at most 1024 characters.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
negate:
type: boolean
example: true
description: Specifies the absence of the pattern.
indicator_type:
type: array
items:
type: string
enum:
- Anonymization
- C2
- Compromised PKI Certificate
- Domain Watchlist
- Exfiltration
- File Hash Watchlist
- Host Characteristics
- IMEI Watchlist
- IMSI Watchlist
- IP Watchlist
- Login Name
- Malicious E-mail
- Malware Artifacts
- Private Threat Feed
- URL Watchlist
example: Anonymization
example:
- Anonymization
description: Specifies the type or types for this Indicator.
tags:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Descriptors for this indicator.
composite_indicator_expression:
type: object
properties:
operator:
type: string
enum:
- and
- not
- or
example: and
indicator_ids:
type: array
items:
type: string
example: string
description: A URI leading to an indicator.
example:
- string
required:
- operator
- indicator_ids
example:
operator: and
indicator_ids:
- string
likely_impact:
type: string
example: string
description: Likely potential impact within the relevant context if this Indicator were to occur.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: level of confidence held in the accuracy of this Indicator.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: Relevant kill chain phases indicated by this Indicator.
test_mechanisms:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
specification:
type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
x-anyOf:
- type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
- type: object
properties:
type:
type: string
enum:
- ThreatBrain
example: ThreatBrain
query:
type: string
example: string
variables:
type: array
items:
type: string
example: string
example:
- string
required:
- type
- variables
example:
type: ThreatBrain
query: string
variables:
- string
description: An indicator which runs in threatbrain...
- type: object
properties:
type:
type: string
enum:
- Snort
example: Snort
snort_sig:
type: string
example: string
required:
- type
- snort_sig
example:
type: Snort
snort_sig: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- SIOC
example: SIOC
SIOC:
type: string
example: string
required:
- type
- SIOC
example:
type: SIOC
SIOC: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- OpenIOC
example: OpenIOC
open_IOC:
type: string
example: string
required:
- type
- open_IOC
example:
type: OpenIOC
open_IOC: string
description: An indicator which contains an XML blob of an openIOC indicator.
required:
- producer
example:
description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: For submitting a new Indicator
uniqueItems: true
example:
- description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: a list of `NewIndicator`s.
judgements:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- judgement
example: judgement
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
disposition:
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Matches :disposition_name as in {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}
disposition_name:
type: string
enum:
- Clean
- Common
- Malicious
- Suspicious
- Unknown
example: Clean
description: String verdict identifiers.
priority:
type: integer
format: int64
example: 10
description: A value 0-100 that determine the priority of a judgement. Curated feeds of black/white lists, for example known good products within your organizations, should use a 95. All automated systems should use a priority of 90, or less. Human judgements should have a priority of 100, so that humans can always override machines.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
reason:
type: string
example: string
description: String with at most 1024 characters.
reason_uri:
type: string
example: string
description: A URI
required:
- source
- observable
- priority
- confidence
- severity
example:
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
description: Schema for submitting new Judgements.
uniqueItems: true
example:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
description: a list of `NewJudgement`s.
malwares:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- malware
example: malware
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
labels:
type: array
items:
type: string
example: adware
description: Malware label is an open vocabulary that represents different types and functions of malware. Malware labels are not mutually exclusive; a malware instance can be both spyware and a screen capture tool.
example:
- adware
description: The type of malware being described.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: The list of Kill Chain Phases for which this Malware can be used.
x_mitre_aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Software.aliases.
abstraction_level:
type: string
enum:
- family
- variant
- version
example: family
description: Malware abstraction level.
required:
- title
- description
- short_description
- labels
example:
description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new Malware.
uniqueItems: true
example:
- description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewMalware`s.
notes:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- note
example: note
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
note_class:
type: string
example: keyword
content:
type: string
example: string
description: Markdown string with at most 5000 characters.
related_entities:
type: array
items:
type: object
properties:
entity_type:
type: string
example: string
entity_id:
type: string
example: string
description: A URI leading to an entity.
required:
- entity_type
- entity_id
example:
entity_type: string
entity_id: string
example:
- entity_type: string
entity_id: string
author:
type: string
example: string
required:
- note_class
- content
- related_entities
example:
schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
description: Schema for submitting Notes
uniqueItems: true
example:
- schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
description: a list of `NewNote`s.
relationships:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- relationship
example: relationship
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
relationship_type:
type: string
example: attributed-to
source_ref:
type: string
example: string
description: A URI leading to an entity.
target_ref:
type: string
example: string
description: A URI leading to an entity.
required:
- relationship_type
- source_ref
- target_ref
example:
description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
description: Schema for submitting new Relationships.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
description: a list of `NewRelationship`s.
sightings:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- sighting
example: sighting
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
count:
type: integer
format: int64
example: 10
description: 'The number of times an indicator was observed within a certain period of time.
For example, if an IP address associated with known malicious activity is observed once within a period of time, it may indicate a low-level threat. However, if the same IP address is observed multiple times within a short time frame, it may indicate a more severe and persistent threat.
It can also be used to prioritize security alerts and indicate the urgency of a response. High counts indicate that an indicator is actively being used in a larger campaign, while low counts may indicate isolated incidents.'
internal:
type: boolean
example: false
description: "If `true`, indicates that the sighting was reported from internal sources, such as an organization's own internal security tools or SOC.\n Internal sightings are often considered more reliable and actionable than external sightings, which are reported from external sources and may have a lower level of trustworthiness. Internal sightings can provide more context and can help identify potential threats that are unique to a particular environment or organization.\n Internal sightings can also help organizations prioritize their security response efforts by identifying threats that are specific to their environment and may not yet be widely known."
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
resolution:
type: string
example: detected
description: Represents the disposition or actions taken on the associated threat intelligence.
data:
type: object
properties:
columns:
type: array
items:
type: object
properties:
name:
type: string
example: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
example: integer
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
type: boolean
example: true
description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`.
short_description:
type: string
example: string
required:
- name
- type
example:
name: string
type: integer
description: string
required: true
short_description: string
example:
- name: string
type: integer
description: string
required: true
short_description: string
description: an ordered list of column definitions
rows:
type: array
items:
type: array
items:
example: anything
example:
- - anything
description: an ordered list of rows
row_count:
type: integer
format: int64
example: 10
description: The number of rows in the data table.
required:
- columns
- rows
example:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: An embedded data table for the Sighting.
sensor:
type: string
example: endpoint
description: The OpenC2 Actuator name that best fits the device that is creating this sighting (e.g. network.firewall)
sensor_coordinates:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
os:
type: string
example: string
required:
- type
- observables
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
description: Describes the device that made the sighting (sensor) and contains identifying observables for the sensor.
targets:
type: array
items:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
os:
type: string
example: string
required:
- type
- observables
- observed_time
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
description: Describes the target of the sighting and contains identifying observables for the target.
example:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
description: 'May include one or more targets that observed the associated indicator. Targets can include network devices, host devices, or other entities that are capable of detecting indicators of compromise.
Can be used to assess the scope of potential threats, helping analysts understand which devices or components of the network may be vulnerable to attack. For example, if a particular malware strain is detected on several different systems within an organization, the `targets` field may indicate which systems are affected and which may need to be isolated or patched to prevent further spread.'
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
description: The object(s) of interest.
relations:
type: array
items:
type: object
properties:
origin:
type: string
example: string
origin_uri:
type: string
example: string
description: A URI
relation:
type: string
example: Allocated
relation_info:
type: object
additionalProperties:
example: anything
example:
keyword: anything
properties: {}
source:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
related:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
required:
- origin
- relation
- source
- related
example:
origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
description: A relation inside a Sighting.
example:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
description: Provide any context we can about where the observable came from.
context:
type: object
properties:
process_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- ProcessCreateEvent
example: ProcessCreateEvent
process_args:
type: string
example: string
description: String with at most 2048 characters.
process_hash:
type: string
example: string
description: String with at most 2048 characters.
process_size:
type: integer
format: int64
example: 10
process_disposition:
type: string
example: string
description: String with at most 1024 characters.
parent_creation_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
parent_process_id:
type: integer
format: int64
example: 10
parent_process_guid:
type: integer
format: int64
example: 10
parent_process_name:
type: string
example: string
description: String with at most 1024 characters.
parent_process_args:
type: string
example: string
description: String with at most 2048 characters.
parent_process_username:
type: string
example: string
description: String with at most 1024 characters.
parent_process_hash:
type: string
example: string
description: String with at most 2048 characters.
parent_process_size:
type: integer
format: int64
example: 10
parent_process_disposition:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- type
example:
parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
example:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
description: a list of `ProcessCreate`
library_load_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- LibraryLoadEvent
example: LibraryLoadEvent
dll_library_name:
type: string
example: string
description: String with at most 1024 characters.
dll_library_path:
type: string
example: string
description: String with at most 2048 characters.
required:
- time
- process_id
- process_name
- type
- dll_library_name
- dll_library_path
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
description: a list of `LibraryLoadType`
file_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileCreateEvent
example: FileCreateEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileCreateType`
file_delete_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileDeleteEvent
example: FileDeleteEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileDeleteType`
file_modify_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileModifyEvent
example: FileModifyEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileModifyType`
file_move_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileMoveEvent
example: FileMoveEvent
old_name:
type: string
example: string
description: String with at most 1024 characters.
new_name:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
- old_name
- new_name
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
description: a list of `FileMoveType`
netflow_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- NetflowEvent
example: NetflowEvent
traffic:
type: object
properties:
protocol:
type: integer
format: int64
example: 10
description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
source_ip:
type: string
example: string
destination_ip:
type: string
example: string
source_port:
type: integer
format: int64
example: 10
destination_port:
type: integer
format: int64
example: 10
direction:
type: string
enum:
- incoming
- outgoing
example: incoming
destination_host_name:
type: string
example: string
source_subnet:
type: string
example: string
destination_subnet:
type: string
example: string
required:
- protocol
- source_ip
- destination_ip
- source_port
- destination_port
- direction
example:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
process_path:
type: string
example: string
description: String with at most 1024 characters.
process_args:
type: string
example: string
description: String with at most 1024 characters.
process_hash:
type: string
example: string
description: String with at most 1024 characters.
process_account_type:
type: string
example: string
description: String with at most 1024 characters.
process_account:
type: string
example: string
description: String with at most 1024 characters.
parent_process_id:
type: integer
format: int64
example: 10
parent_process_name:
type: string
example: string
description: String with at most 1024 characters.
parent_process_path:
type: string
example: string
description: String with at most 1024 characters.
parent_process_args:
type: string
example: string
description: String with at most 1024 characters.
parent_process_hash:
type: string
example: string
description: String with at most 1024 characters.
parent_process_account:
type: string
example: string
description: String with at most 1024 characters.
parent_process_account_type:
type: string
example: string
description: String with at most 1024 characters.
flow_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
byte_count_out:
type: integer
format: int64
example: 10
byte_count_in:
type: integer
format: int64
example: 10
required:
- time
- process_id
- process_name
- type
- traffic
example:
parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
example:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
description: a list of `NetflowType`
http_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- HTTPEvent
example: HTTPEvent
host:
type: string
example: string
description: String with at most 1024 characters.
traffic:
type: object
properties:
protocol:
type: integer
format: int64
example: 10
description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
source_ip:
type: string
example: string
destination_ip:
type: string
example: string
source_port:
type: integer
format: int64
example: 10
destination_port:
type: integer
format: int64
example: 10
direction:
type: string
enum:
- incoming
- outgoing
example: incoming
destination_host_name:
type: string
example: string
source_subnet:
type: string
example: string
destination_subnet:
type: string
example: string
required:
- protocol
- source_ip
- destination_ip
- source_port
- destination_port
- direction
example:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
url_port:
type: integer
format: int64
example: 10
query:
type: string
example: string
description: String with at most 5000 characters.
encrypted:
type: boolean
example: true
method:
type: string
enum:
- CONNECT
- GET
- HEAD
- OPTIONS
- PATCH
- POST
- PUT
- TRACE
example: CONNECT
required:
- time
- process_id
- process_name
- type
- host
- traffic
example:
process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
example:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
description: a list of `HTTPType`
registry_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryCreateEvent
example: RegistryCreateEvent
required:
- time
- process_id
- process_name
- registry_key
- type
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
description: a list of `RegistryCreateType`
registry_set_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistrySetEvent
example: RegistrySetEvent
registry_value:
type: string
example: string
description: String with at most 2048 characters.
registry_data_length:
type: integer
format: int64
example: 10
registry_data:
type: string
example: string
description: String with at most 5000 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
- registry_value
example:
process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
example:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
description: a list of `RegistrySetType`
registry_delete_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryDeleteEvent
example: RegistryDeleteEvent
registry_value:
type: string
example: string
description: String with at most 2048 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
description: a list of `RegistryDeleteType`
registry_rename_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryRenameEvent
example: RegistryRenameEvent
registry_old_key:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
- registry_old_key
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
description: a list of `RegistryRenameType`
example:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
description: Context including the event type that best fits the type of the sighting.
activity_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the malicious activity occurred. For example, the time when a malware sample was executing, or the time range of a network intrusion.
detection_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the malicious activity was detected by the source engine or security tool. This may differ from the activity_interval if detection occurred after the activity.
modification_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the sighting record was created or last updated in the system.
required:
- observed_time
example:
description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: For submitting a new Sighting.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: a list of `NewSighting`s.
identity_assertions:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- identity-assertion
example: identity-assertion
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
identity:
type: object
properties:
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
required:
- observables
example:
observables:
- value: 1.2.3.4
type: ip
description: Attributes for which the assertion is being made.
assertions:
type: array
items:
type: object
properties:
name:
type: string
example: cisco:ctr:ad:host_domain_name
description: An open vocabulary containing well known assertion types
value:
type: string
example: string
required:
- name
- value
example:
name: cisco:ctr:ad:host_domain_name
value: string
example:
- name: cisco:ctr:ad:host_domain_name
value: string
description: Any known context about the identity attributes.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- identity
- assertions
example:
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
description: For submitting a new IdentityAssertion.
uniqueItems: true
example:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
description: a list of `NewIdentityAssertion`s.
target_records:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- target-record
example: target-record
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
targets:
type: array
items:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
os:
type: string
example: string
description: Source Operating System where TargetRecord was originated.
internal:
type: boolean
example: false
description: Is it internal to our network?
sensor:
type: string
example: string
description: 'The OpenC2 Actuator name that best fits the device that is creating this TargetRecord (e.g.: network.firewall, etc.)'
source_uri:
type: string
example: string
description: A URI
required:
- type
- observables
- observed_time
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
description: Schema for TargetRecord Targets
example:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
required:
- source
- targets
example:
description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new TargetRecord.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewTargetRecord`s.
tools:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- tool
example: tool
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
labels:
type: array
items:
type: string
example: credential-exploitation
description: Tool labels describe the categories of tools that can be used to perform attacks.
example:
- credential-exploitation
description: The kind(s) of tool(s) being described.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: The list of kill chain phases for which this Tool can be used.
tool_version:
type: string
example: string
description: The version identifier associated with the Tool.
x_mitre_aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Software.aliases.
required:
- title
- description
- short_description
- labels
example:
description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new Tool.
uniqueItems: true
example:
- description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewTool`s.
verdicts:
type: array
items:
type: object
properties:
type:
type: string
enum:
- verdict
example: verdict
disposition:
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Numeric verdict identifiers.
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
disposition_name:
type: string
enum:
- Clean
- Common
- Malicious
- Suspicious
- Unknown
example: Clean
description: 'The disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}'
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- type
- disposition
- observable
- valid_time
example:
type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: "A Verdict is chosen from all of the Judgements on that Observable which have not yet expired. The highest priority Judgement becomes the active verdict. If there is more than one Judgement with that priority, then Clean disposition has priority over all others, then Malicious disposition, and so on down to Unknown.\n\n The ID of a verdict is a a str of the form \"observable.type:observable.value\" for example, \"ip:1.1.1.1\""
uniqueItems: true
example:
- type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: a list of `Verdict`s.
data_tables:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- data-table
example: data-table
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
columns:
type: array
items:
type: object
properties:
name:
type: string
example: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
example: integer
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
type: boolean
example: true
description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`.
short_description:
type: string
example: string
required:
- name
- type
example:
name: string
type: integer
description: string
required: true
short_description: string
example:
- name: string
type: integer
description: string
required: true
short_description: string
description: An ordered list of column definitions.
rows:
type: array
items:
type: array
items:
example: anything
example:
- - anything
description: An ordered list of rows
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
row_count:
type: integer
format: int64
example: 10
description: The number of rows in the data table.
required:
- columns
- rows
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting a NewDataTable record.
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewDataTable`s.
weaknesses:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- weakness
example: weakness
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: Should be short and limited to the key points that define this weakness.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
structure:
type: string
enum:
- Chain
- Composite
- Simple
example: Chain
description: Defines the structural nature of the weakness.
languages:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Language name (Clojure, Java, ...)
class:
type: string
example: Assembly
description: Class of language.
required:
- prevalence
example:
prevalence: Often
name: string
class: Assembly
example:
- prevalence: Often
name: string
class: Assembly
description: Applicable Languages.
operating_systems:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: String with at most 1024 characters.
version:
type: string
example: string
description: String with at most 1024 characters.
cpe_id:
type: string
example: string
description: String with at most 1024 characters.
class:
type: string
example: Android
description: Class of Operating System.
required:
- prevalence
example:
prevalence: Often
name: string
version: string
cpe_id: string
class: Android
example:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
description: Applicable operating systems.
architectures:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Architecture name (ARM, x86, ...)
class:
type: string
example: Embedded
description: Class of architecture
required:
- prevalence
example:
prevalence: Often
name: string
class: Embedded
example:
- prevalence: Often
name: string
class: Embedded
description: Applicable architectures.
paradigms:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Paradigm name (Client Server, Mainframe)
required:
- prevalence
example:
prevalence: Often
name: string
example:
- prevalence: Often
name: string
description: Applicable paradigms.
technologies:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Technology name (Web Server, Web Client)
required:
- prevalence
example:
prevalence: Often
name: string
example:
- prevalence: Often
name: string
description: Applicable technologies.
background_details:
type: string
example: string
description: Information that is relevant but not related to the nature of the weakness itself.
alternate_terms:
type: array
items:
type: object
properties:
term:
type: string
example: string
description: The actual alternate term.
description:
type: string
example: string
description: Provides context for the alternate term by which this weakness may be known.
required:
- term
example:
term: string
description: string
example:
- term: string
description: string
description: Indicates one or more other names used to describe this weakness.
modes_of_introduction:
type: array
items:
type: object
properties:
phase:
type: string
example: Architecture and Design
description: Identifies the point in the software life cycle at which the weakness may be introduced.
note:
type: string
example: string
description: Provides a typical scenario related to introduction during the given phase.
required:
- phase
example:
phase: Architecture and Design
note: string
example:
- phase: Architecture and Design
note: string
description: Information about how and when a given weakness may be introduced.
likelihood:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Likelihood of exploit.
common_consequences:
type: array
items:
type: object
properties:
scopes:
type: array
items:
type: string
example: Access Control
description: Defines the different areas of software security that can be affected by exploiting a weakness.
example:
- Access Control
description: Identifies the security property that is violated.
impacts:
type: array
items:
type: string
example: Alter Execution Logic
example:
- Alter Execution Logic
description: Describes the technical impact that arises if an adversary succeeds in exploiting this weakness.
likelihood:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: How likely the specific consequence is expected to be seen relative to the other consequences.
note:
type: string
example: string
description: Additional commentary about a consequence.
required:
- scopes
example:
scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
example:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
description: Refers to the typical or expected negative effects that can result from exploiting the weakness. This could include anything from unauthorized access to data, denial of service, system crashes or other things.
detection_methods:
type: array
items:
type: object
properties:
method:
type: string
example: Architecture or Design Review
description: Identifies the particular detection method being described.
description:
type: string
example: string
description: Provides some context of how this method can be applied to a specific weakness.
effectiveness:
type: string
example: High
description: How effective the detection method may be in detecting the associated weakness.
effectiveness_notes:
type: string
example: string
description: Provides additional discussion of the strengths and shortcomings of this detection method.
required:
- method
- description
example:
method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
example:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
description: Identifies methods that may be employed to detect this weakness, including their strengths and limitations.
potential_mitigations:
type: array
items:
type: object
properties:
description:
type: string
example: string
description: A description of this individual mitigation including any strengths and shortcomings of this mitigation for the weakness.
phases:
type: array
items:
type: string
example: Architecture and Design
description: Defines the different regularities that guide the applicability of platforms.
example:
- Architecture and Design
description: Indicates the development life cycle phase during which this particular mitigation may be applied.
strategy:
type: string
example: Attack Surface Reduction
description: A general strategy for protecting a system to which this mitigation contributes.
effectiveness:
type: string
example: Defense in Depth
description: Summarizes how effective the mitigation may be in preventing the weakness.
effectiveness_notes:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
- description
example:
description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
example:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
description: Describes potential mitigations associated with a weakness.
functional_areas:
type: array
items:
type: string
example: Authentication
description: Defines the different functional areas of software in which the weakness may appear.
example:
- Authentication
description: Identifies the functional area of the software in which the weakness is most likely to occur.
affected_resources:
type: array
items:
type: string
example: CPU
description: Defines a resource of a system.
example:
- CPU
description: Identifies system resources that can be affected by an exploit of this weakness.
notes:
type: array
items:
type: object
properties:
type:
type: string
example: Applicable Platform
description: Defines the different types of notes that can be associated with a weakness.
note:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
- type
- note
example:
type: Applicable Platform
note: string
example:
- type: Applicable Platform
note: string
description: Provides any additional comments about the weakness.
abstraction_level:
type: string
enum:
- Base
- Class
- Compound
- Variant
example: Base
description: Refers to the level of abstraction or granularity used to describe the weakness. It helps to categorize the vulnerability based on the level of detail provided.
required:
- description
example:
description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
description: For submitting a new weakness.
uniqueItems: true
example:
- description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
description: a list of `NewWeakness`s.
vulnerabilities:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- vulnerability
example: vulnerability
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: "Various sources of vulnerability information can be used, including third-party resources like the National Vulnerability Database (NVD) and the Common Vulnerabilities and Exposures (CVE) database. The platform then analyzes this data and provides the user with relevant details such as the severity of the vulnerability, the affected systems, and remediation recommendations. \n\n Based on this information, the user can prioritize patching and other mitigation strategies to reduce the risk of potential attacks."
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
cve:
type: object
properties:
cve_data_meta:
type: object
properties:
id:
type: string
example: string
description: String with at most 1024 characters.
assigner:
type: string
example: string
description: String with at most 1024 characters.
example:
id: string
assigner: string
required:
- cve_data_meta
example:
cve_data_meta:
id: string
assigner: string
impact:
type: object
properties:
cvss_v2:
type: object
properties:
vector_string:
type: string
example: string
description: a text representation of a set of CVSSv2 metrics. It is commonly used to record or transfer CVSSv2 metric information in a concise form
base_score:
type: number
format: double
example: 10.0
description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v2/guide'
base_severity:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
impact_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
exploitability_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
access_vector:
type: string
enum:
- adjacent network
- local
- network
example: network
description: This metric reflects how the vulnerability is exploited.The more remote an attacker can be to attack a host, the greater the vulnerability score.
access_complexity:
type: string
enum:
- high
- low
- medium
example: low
description: 'This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system. For example, consider a buffer overflow in an Internet service: once the target system is located, the attacker can launch an exploit at will.'
authentication:
type: string
enum:
- multiple
- none
- single
example: none
description: This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. This metric does not gauge the strength or complexity of the authentication process, only that an attacker is required to provide credentials before an exploit may occur. The fewer authentication instances that are required, the higher the vulnerability score.
confidentiality_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact on confidentiality of a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. Increasedconfidentiality impact increases the vulnerability score.
integrity_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information. Increased integrity impact increases the vulnerability score.
availability_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact to availability of a successfully exploited vulnerability. Availability refers to the accessibility of information resources. Attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system. Increased availability impact increases the vulnerability score.
exploitability:
type: string
enum:
- functional
- high
- not_defined
- proof_of_concept
- unproven
example: not_defined
description: This metric measures the current state of exploit techniques or code availability. Public availability of easy-to-use exploit code increases the number of potential attackers by including those who are unskilled thereby increasing the severity of the vulnerability.
remediation_level:
type: string
enum:
- not_defined
- official_fix
- temporary_fix
- unavailable
- workaround
example: not_defined
description: The remediation level of a vulnerability is an important factor for prioritization. The typical vulnerability is unpatched when initially published. Workarounds or hotfixes may offer interim remediation until an official patch or upgrade is issued. Each of these respective stages adjusts the temporal score downwards, reflecting the decreasing urgency as remediation becomes final. The less official and permanent a fix, the higher the vulnerability score is.
report_confidence:
type: string
enum:
- confirmed
- not_defined
- unconfirmed
- uncorroborated
example: not_defined
description: This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details. Sometimes, only the existence of vulnerabilities are publicized, but without specific details. The vulnerability may later be corroborated and then confirmed through acknowledgement by the author or vendor of the affected technology. The urgency of a vulnerability is higher when a vulnerability is known to exist with certainty. This metric also suggests the level of technical knowledge available to would-be attackers. The more a vulnerability is validated by the vendor or other reputable sources, the higher the score.
temporal_vector_string:
type: string
example: string
description: A text representation of a set of CVSSv2 temporal metrics. Temporal metrics allow analysists to calculate threat severity based on temporal factors such as reliability of vulnerability reports, availability of mitigations, and the ease or difficulty of conducting the exploit. It is commonly used to record or transfer CVSSv2 metric information in a concise form
collateral_damage_potential:
type: string
enum:
- high
- low
- low_medium
- medium_high
- none
- not_defined
example: not_defined
description: This metric measures the potential for loss of life or physical assets through damage or theft of property or equipment. The metric may also measure economic loss of productivity or revenue. Naturally, the greater the damage potential, the higher the vulnerability score.
target_distribution:
type: string
enum:
- high
- low
- medium
- none
- not_defined
example: not_defined
description: This metric measures the proportion of vulnerable systems. It is meant as an environment-specific indicator in order to approximate the percentage of systems that could be affected by the vulnerability. The greater the proportion of vulnerable systems, the higher the score.
confidentiality_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
integrity_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
availability_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
environmental_vector_string:
type: string
example: string
description: A text representation of a set of CVSSv2 environmental metrics. Environmental metrics allow analysists to calculate threat scores in relation to environmental security requirements, collateral damage potential, and target availability. It is commonly used to record or transfer CVSSv2 metric information in a concise form
obtain_all_privilege:
type: boolean
example: true
obtain_user_privilege:
type: boolean
example: true
obtain_other_privilege:
type: boolean
example: true
user_interaction_required:
type: boolean
example: true
required:
- vector_string
- base_score
- base_severity
example:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
type: object
properties:
vector_string:
type: string
example: string
description: a text representation of a set of CVSSv3 metrics. It is commonly used to record or transfer CVSSv3 metric information in a concise form
base_score:
type: number
format: double
example: 10.0
description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v3-1'
base_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
impact_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
exploitability_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
attack_vector:
type: string
enum:
- adjacent_network
- local
- network
- physical
example: adjacent_network
description: Reflects the context by which vulnerability exploitation is possible
modified_attack_vector:
type: string
enum:
- adjacent_network
- local
- network
- not_defined
- physical
example: not_defined
description: modified attack vector
attack_complexity:
type: string
enum:
- high
- low
example: high
description: describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability
modified_attack_complexity:
type: string
enum:
- high
- low
- not_defined
example: not_defined
description: modified attack complexity
privileges_required:
type: string
enum:
- high
- low
- none
example: high
description: describes the level of privileges an attacker must possess before successfully exploiting the vulnerability
modified_privileges_required:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified privileges required
user_interaction:
type: string
enum:
- none
- required
example: none
description: captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component
modified_user_interaction:
type: string
enum:
- none
- not_defined
- required
example: none
description: modified user interaction
scope:
type: string
enum:
- changed
- unchanged
example: changed
description: the ability for a vulnerability in one software component to impact resources beyond its means, or privileges
modified_scope:
type: string
enum:
- changed
- not_defined
- unchanged
example: not_defined
description: modified scope
confidentiality_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability
modified_confidentiality_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified confidentiality impact
integrity_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to integrity of a successfully exploited vulnerability
modified_integrity_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified integrity impact
availability_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability
modified_availability_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified availability impact
exploit_code_maturity:
type: string
enum:
- functional
- high
- not_defined
- proof_of_concept
- unproven
example: functional
description: measures the likelihood of the vulnerability being attacked
remediation_level:
type: string
enum:
- high
- not_defined
- offical_fix
- temporary_fix
- unavailable
- workaround
example: high
description: Remediation Level of a vulnerability is an important factor for prioritization
report_confidence:
type: string
enum:
- confirmed
- reasonable
- unknown
example: confirmed
description: measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details
temporal_score:
type: number
format: double
example: 10.0
description: Round up(CVSSv3BaseScore × CVSSv3ExploitCodeMaturity × CVSSv3RemediationLevel × CVSSv3ReportConfidence)
temporal_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
description: temporal severity
availability_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
confidentiality_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
integrity_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
environmental_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
environmental_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
required:
- vector_string
- base_score
- base_severity
example:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
example:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: "Describes the potential impact of a vulnerability that is being tracked in the system. Provides information on the extent of damage that a vulnerability can cause and how serious the consequences could be if it is exploited. \n\nMay contain granular information about the vulnerability severity using the CVSS system, versions 2 and 3.\n\nCVSSv2 and CVSSv3 have different methods of calculating base scores, but both are designed to provide an indication of the level of risk that a vulnerability poses. The base score ranges from 0 to 10, with 10 being the most severe. Additionally, both CVSSv2 and CVSSv3 define severity levels, such as low, medium, high, and critical, based on the base score."
configurations:
type: object
properties:
CVE_data_version:
type: string
example: string
description: Specifies the version of the CVE (Common Vulnerabilities and Exposures) dictionary used by the vulnerability information provider.
nodes:
type: array
items:
type: object
properties:
operator:
type: string
enum:
- AND
- OR
example: AND
description: The operator string influences how seqs of cpe matches are related to one another.
cpe_match:
type: array
items:
type: object
properties:
vulnerable:
type: boolean
example: true
cpe23Uri:
type: string
example: string
description: A text representation of a software or hardware platform.
versionStartIncluding:
type: string
example: string
description: A string representing the lower bound(inclusive) of version in the CPE.
versionEndIncluding:
type: string
example: string
description: A string representing the upper bound(inclusive) of version in the CPE.
versionStartExcluding:
type: string
example: string
description: A string representing the lower bound(exclusive) of version in the CPE.
versionEndExcluding:
type: string
example: string
description: A string representing the upper bound(exclusive) of version in the CPE.
required:
- vulnerable
- cpe23Uri
example:
vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
example:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
type: array
items:
type: object
properties:
operator:
type: string
enum:
- AND
- OR
example: AND
description: The operator string influences how seqs of cpe matches are related to one another.
cpe_match:
type: array
items:
type: object
properties:
vulnerable:
type: boolean
example: true
cpe23Uri:
type: string
example: string
description: A text representation of a software or hardware platform.
versionStartIncluding:
type: string
example: string
description: A string representing the lower bound(inclusive) of version in the CPE.
versionEndIncluding:
type: string
example: string
description: A string representing the upper bound(inclusive) of version in the CPE.
versionStartExcluding:
type: string
example: string
description: A string representing the lower bound(exclusive) of version in the CPE.
versionEndExcluding:
type: string
example: string
description: A string representing the upper bound(exclusive) of version in the CPE.
required:
- vulnerable
- cpe23Uri
example:
vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
example:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate:
type: boolean
example: true
description: Negates operator when true.
required:
- operator
- cpe_match
example:
operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
example:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate:
type: boolean
example: true
description: Negates operator when true.
required:
- operator
example:
operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
example:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
description: Each `node` in the CTIM standard configuration includes information such as the `operator` (such as "less than", or "greater than or equal to"), and the `cpe` (Common Platform Enumeration) string which identifies the specific software, `CPE` is a structured naming scheme for IT systems, platforms, and software packages, and it is instrumental in enabling data exchange between different systems.
required:
- CVE_data_version
- nodes
example:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
description: "Represents a list of affected versions or configurations of a software component that is impacted by a vulnerability. \nBy tracking the affected software components and versions, defenders can identify which systems are potentially exposed to an attack, and apply appropriate mitigations."
published_date:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: "Represents the date when a vulnerability was publicly disclosed or made available to the general public. \n\nImportant for tracking the age of a vulnerability, as well as for determining when a particular vulnerability was first introduced into a system. The published date can be used to identify the time window during which a system may have been vulnerable to a particular exploit.\n\nFor example, if an organization discovers that a vulnerability was published before their system's installation date, but they did not apply the necessary security updates in a timely manner, it can be concluded that their system was vulnerable for the period between the installation date and the date when the necessary security updates were applied."
last_modified_date:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: 'Represents the date when the vulnerability metadata was last updated in the internal database.
It can be used to track the freshness of the vulnerability information. If the `last_modified_date` is more recent than the `published_date`, it can indicate that there has been some new information or updates related to the vulnerability, such as new patch releases or changes in the severity or impact rating.'
required:
- description
example:
description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: For submitting a new vulnerability.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: a list of `NewVulnerability`s.
actor_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_mapping_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_properties_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
attack_pattern_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
campaign_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
coa_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
feedback_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
identity_assertion_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
incident_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
indicator_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
judgement_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
malware_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
note_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
relationship_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
sighting_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
target_record_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
tool_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
verdict_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
data_table_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
weakness_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
vulnerability_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- source
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
asset_mapping_refs:
- string
note_refs:
- string
data_table_refs:
- string
attack_pattern_refs:
- string
sighting_refs:
- string
schema_version: 1.3.30
revision: 10
assets:
- description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
weakness_refs:
- string
tool_refs:
- string
target_record_refs:
- string
asset_refs:
- string
tools:
- description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
indicators:
- description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
attack_patterns:
- description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
type: bundle
weaknesses:
- description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
source: string
external_ids:
- string
feedback_refs:
- string
asset_properties:
- properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
short_description: string
feedbacks:
- feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
judgement_refs:
- string
title: string
coa_refs:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
verdicts:
- type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
campaigns:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
source_uri: string
actors:
- description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
indicator_refs:
- string
actor_refs:
- string
language: string
data_tables:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
id: string
notes:
- schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
identity_assertions:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
judgements:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
malwares:
- description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
target_records:
- description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
asset_mappings:
- asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
relationship_refs:
- string
tlp: green
incidents:
- description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
identity_assertion_refs:
- string
sightings:
- description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
campaign_refs:
- string
vulnerability_refs:
- string
asset_properties_refs:
- string
relationships:
- description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
timestamp: '2016-01-01T01:01:01Z'
verdict_refs:
- string
malware_refs:
- string
incident_refs:
- string
vulnerabilities:
- description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
coas:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: Describes a Bundle of any set of CTIM entities.
investigated_observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
required:
- bundle
application/transit+msgpack:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- bundle
example: bundle
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
actors:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- actor
example: actor
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Indicates the time span for which the information about the Actor is relevant, and after which it could become outdated.
actor_types:
type: array
items:
type: string
example: Cyber Espionage Operations
example:
- Cyber Espionage Operations
identity:
type: object
properties:
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
related_identities:
type: array
items:
type: object
properties:
identity:
type: string
example: string
description: The reference (URI) of the related Identity object.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Specifies the level of confidence in the assertion of the relationship between the two objects.
information_source:
type: string
example: string
description: Specifies the source of the information about the relationship between the two components.
relationship:
type: string
example: string
required:
- identity
example:
identity: string
confidence: High
information_source: string
relationship: string
description: Describes a related Identity
example:
- identity: string
confidence: High
information_source: string
relationship: string
description: Identifies other entity Identities related to this Identity.
required:
- description
- related_identities
example:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
description: Can contain information such as the name of the attacker, the group or organization they belong to, or any other identifier that can help in the attribution process.
motivation:
type: string
example: Ego
description: The reason or purpose behind the malicious activity attributed to this Actor. By understanding a threat actor's motivation, analysts can better predict the attacker's behavior and anticipate future malicious actions.
sophistication:
type: string
enum:
- Aspirant
- Expert
- Innovator
- Novice
- Practitioner
example: Aspirant
description: "Represents the level of expertise and skill that the threat actor has displayed in their malicious activities. Can help security analysts assess the potential impact of an attacker's TTPs and determine the potential attack surface. \n\nFor example, a threat actor with a low sophistication level may primarily rely on off-the-shelf malware and attack tools, while an attacker with high sophistication may use custom tools with advanced evasion techniques, zero-day exploits, and sophisticated methods for command and control of their malware. \n\nThe sophistication level of an attacker can also be inferred based on several factors such as the complexity of attacks, the attacker's knowledge of the targeted organization's systems, and the attacker's ability to remain undetected.\n\nIf an attacker shows a high level of sophistication in reconnaissances, social engineering, and phishing, then the attacker may have a good knowledge of the targeted organization and its employees. This means that the attacker may be more successful in infiltrating the organization's network and compromising its systems."
intended_effect:
type: string
example: Account Takeover
description: "Represents the desired outcome or impact the threat actor is trying to achieve through their malicious activities. \n\n Helps security analysts to understand the attacker's goals beyond the immediate impact of the attack. By understanding the intended effect, analysts can draw connections between seemingly unrelated attacks and build a more complete understanding of an attacker's long-term goals and motivations."
planning_and_operational_support:
type: string
example: string
description: "Provides information about the resources and capabilities of the attacker that could be used to assist in planning and operations related to the threat.\n\n It can be used to describe Infrastructure, Tools, Techniques, and Capabilities used by the threat actor."
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'This field can help analysts decide how much trust they can put in the information provided by the threat intelligence sources.
For example, an Actor entity can have high confidence if the organization''s security researchers have been tracking it for a long time and have gathered a significant amount of intelligence about it through various sources, such as analysis of malware, network traffic, and human intelligence. In contrast, low confidence may indicate the organization has only seen limited or circumstantial evidence.'
aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: A list of other names that this Threat Actor is believed to use.
required:
- source
- title
- description
- short_description
example:
description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
description: Schema for submitting new Actors
uniqueItems: true
example:
- description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
description: a list of `NewActor`s.
assets:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset
example: asset
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: 'Specifies the time range during which the asset is considered valid or accurate.
For example, if an asset entity represents a device, the `valid_time` field could be used to indicate the period during which the device''s configuration information is deemed accurate.'
asset_type:
type: string
enum:
- application
- data
- device
- network
- person
example: application
description: 'Type of the Asset: Device, Person, Application, etc.'
required:
- source
- valid_time
- asset_type
example:
description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new Assets
uniqueItems: true
example:
- description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAsset`s.
asset_mappings:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset-mapping
example: asset-mapping
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: For each asset, we allow for the assertion of time bound properties.This gives us both a record of the current state of the asset,as well as history.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'Level of confidence held in the characterization of this AssetMapping e.g.: is it susceptible to manipulation or translation?'
specificity:
type: string
enum:
- Low
- Medium
- Unique
example: Low
description: Denotes the level of how many assets potentially could have this same identifier.
stability:
type: string
enum:
- Managed
- Physical
- Temporary
example: Managed
description: Do we manage when it changes, or is it always a time bound assignment?
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: An AssetMapping is a record that a specific Observable maps to an Asset for an indicated period of time.
asset_ref:
type: string
example: string
description: URI that points to the mapped Asset.
asset_type:
type: string
enum:
- application
- data
- device
- network
- person
example: application
description: 'Type of the mapped Asset: Device, Person, Application, etc.'
required:
- source
- valid_time
- confidence
- specificity
- stability
- observable
- asset_ref
- asset_type
example:
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
description: Schema for submitting new AssetMapping.
uniqueItems: true
example:
- asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
description: a list of `NewAssetMapping`s.
asset_properties:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset-properties
example: asset-properties
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which the AssetProperties is considered valid.
asset_ref:
type: string
example: string
description: URI that points to the associated Asset.
properties:
type: array
items:
type: object
properties:
name:
type: string
example: string
description: The properties are an open vocabulary.
value:
type: string
example: string
required:
- name
- value
example:
name: string
value: string
example:
- name: string
value: string
required:
- source
- valid_time
- asset_ref
example:
properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new AssetProperties
uniqueItems: true
example:
- properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAssetProperties`s.
attack_patterns:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- attack-pattern
example: attack-pattern
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: A kill chain is a series of steps that an attacker must go through to successfully achieve their objective. The concept was originally developed by the military, but has been adapted to the cybersecurity field to describe the steps an attacker goes through to compromise a target system and achieve their goal.
x_mitre_data_sources:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Data Sources.
x_mitre_platforms:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Platforms.
x_mitre_contributors:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Contributors.
abstraction_level:
type: string
enum:
- aggregate
- category
- detailed
- meta
- standard
example: aggregate
description: The CAPEC abstraction level for patterns describing techniques to attack a system.
required:
- title
- description
- short_description
example:
description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new AttackPattern
uniqueItems: true
example:
- description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAttackPattern`s.
campaigns:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- campaign
example: campaign
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Timestamp for the definition of a specific version of a campaign.
campaign_type:
type: string
example: string
description: 'String value that describes the type of campaign. For example, a campaign type could be ''Ransomware'', ''Advanced Persistent Threat'', ''Business Email Compromise'', ''Phishing'', etc. '
names:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Used to capture alternate names or aliases associated with the campaign. A cyberattack campaign may have multiple names or aliases depending on the group or actor(s) behind the attack, e.g., 'Wannacry' is also known as 'WannaCrypt', 'WCry', 'Wanna Decryptor', etc.
intended_effect:
type: array
items:
type: string
example: Account Takeover
example:
- Account Takeover
description: Characterizes the intended effect of this cyber threat campaign.
status:
type: string
enum:
- Future
- Historic
- Ongoing
example: Future
description: "Indicates current Status of the Campaign. \n\nCan have one of the following values: \n\n- Ongoing: Indicates that the campaign is currently active and ongoing. For example, a mass phishing campaign that is actively targeting users is considered 'ongoing'.\n\n- Historic: Campaign has already occurred and is now in the past.\n\n- Future: This indicates that a campaign is planned or expected to occur in the future. For example, a threat actor may announce their intention to launch a specific cyberattack campaign at a future date."
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Level of confidence held in the characterization of this Campaign.
activity:
type: array
items:
type: object
properties:
date_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Specifies the date and time at which the activity occured.
description:
type: string
example: string
description: A description of the activity.
required:
- date_time
- description
example:
date_time: '2016-01-01T01:01:01Z'
description: string
description: Captures the specific activities or tactics associated with the entity. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc.
example:
- date_time: '2016-01-01T01:01:01Z'
description: string
description: 'Used to capture specific activities or tactics associated with the campaign.
The ''activity'' field is an array of objects, and each element represents a specific activity and time associated with the campaign. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc. By capturing these activities analysts can identify the specific tactics used by the threat actor(s) behind the campaign.'
required:
- title
- description
- short_description
- campaign_type
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
description: Schema for submitting new Campaigns
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
description: a list of `NewCampaign`s.
coas:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- coa
example: coa
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
stage:
type: string
enum:
- Containment
- Eradication
- Identification
- Lessons Learned
- Preparation
- Recovery
- Remedy
- Response
example: Containment
description: Specifies what stage in the cyber threat management lifecycle this Course Of Action is relevant to.
coa_type:
type: string
enum:
- Diplomatic Actions
- Eradication
- Hardening
- Internal Blocking
- Logical Access Restrictions
- Monitoring
- Other
- Patching
- Perimeter Blocking
- Phase
- Physical Access Restrictions
- Playbook
- Policy Actions
- Public Disclosure
- Rebuilding
- Redirection
- Redirection (Honey Pot)
- Task
- Training
example: Diplomatic Actions
description: The type of this COA
objective:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Characterizes the objective to provide guidance on how to mitigate a security incident that has been identified.
impact:
type: string
example: string
description: Characterizes the estimated impact of applying this course of action.
cost:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Characterizes the estimated cost for applying this course of action.
efficacy:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Effectiveness of this course of action in achieving its targeted objective.
related_COAs:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
COA_id:
type: string
example: string
description: A URI leading to a COA.
required:
- COA_id
example:
confidence: High
source: string
relationship: string
COA_id: string
example:
- confidence: High
source: string
relationship: string
COA_id: string
description: Identifies or characterizes relationships to one or more related courses of action.
structured_coa_type:
type: string
enum:
- openc2
example: openc2
open_c2_coa:
type: object
properties:
type:
type: string
enum:
- structured_coa
example: structured_coa
id:
type: string
example: string
description: String with at most 1024 characters.
action:
type: object
properties:
type:
type: string
enum:
- alert
- allow
- augment
- contain
- delete
- deny
- detonate
- distill
- get
- investigate
- locate
- mitigate
- modify
- move
- notify
- other
- pause
- query
- redirect
- remediate
- report
- response
- restart
- restore
- resume
- save
- scan
- set
- snapshot
- start
- stop
- substitute
- sync
- throttle
- update
example: alert
required:
- type
example:
type: alert
target:
type: object
properties:
type:
type: string
example: acudid
specifiers:
type: string
example: string
description: Observable types that can be acted upon.
required:
- type
example:
type: acudid
specifiers: string
actuator:
type: object
properties:
type:
type: string
enum:
- endpoint
- endpoint.digital-telephone-handset
- endpoint.laptop
- endpoint.pos-terminal
- endpoint.printer
- endpoint.sensor
- endpoint.server
- endpoint.smart-meter
- endpoint.smart-phone
- endpoint.tablet
- endpoint.workstation
- network
- network.bridge
- network.firewall
- network.gateway
- network.guard
- network.hips
- network.hub
- network.ids
- network.ips
- network.modem
- network.nic
- network.proxy
- network.router
- network.security_manager
- network.sense_making
- network.sensor
- network.switch
- network.vpn
- network.wap
- other
- process
- process.aaa-server
- process.anti-virus-scanner
- process.connection-scanner
- process.directory-service
- process.dns-server
- process.email-service
- process.file-scanner
- process.location-service
- process.network-scanner
- process.remediation-service
- process.reputation-service
- process.sandbox
- process.virtualization-service
- process.vulnerability-scanner
example: endpoint
specifiers:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: List of additional properties describing the actuator.
required:
- type
example:
type: endpoint
specifiers:
- string
modifiers:
type: object
properties:
delay:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
duration:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
frequency:
type: string
example: string
description: String with at most 1024 characters.
id:
type: string
example: string
description: String with at most 1024 characters.
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
response:
type: string
enum:
- acknowledge
- command-ref
- query
- status
example: acknowledge
source:
type: string
example: string
description: String with at most 1024 characters.
destination:
type: string
enum:
- copy-to
- modify-to
- move-to
- report-to
- restore-point
- save-to
- set-to
example: copy-to
method:
type: array
items:
type: string
enum:
- acl
- authenticated
- blackhole
- blacklist
- graceful
- hibernate
- honeypot
- immediate
- segmentation
- spawn
- suspend
- unauthenticated
- whitelist
example: acl
example:
- acl
search:
type: string
enum:
- cve
- patch
- signature
- vendor_bulletin
example: cve
location:
type: string
enum:
- internal
- perimeter
example: internal
option:
type: string
example: string
description: String with at most 1024 characters.
additional_properties:
type: object
properties:
context:
type: string
example: string
description: String with at most 1024 characters.
required:
- context
example:
context: string
example:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
required:
- type
- action
example:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: Schema for submitting new COAs
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: a list of `NewCOA`s.
feedbacks:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- feedback
example: feedback
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
entity_id:
type: string
example: string
description: A URI leading to an entity.
feedback:
type: integer
enum:
- -1
- 0
- 1
example: -1
reason:
type: string
example: string
required:
- entity_id
- feedback
- reason
example:
feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new Feedback.
uniqueItems: true
example:
- feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewFeedback`s.
incidents:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- incident
example: incident
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'Represents the level of certainty or trustworthiness associated with the incident. It denotes the reliability of the intelligence associated with the incident.
The `confidence` field can take on several values, including:
- `info`: Indicates that the incident information is based on sources with no previous track record or there is no track record for the source reporting the incident.
- `low`: Indicates that the incident information is based on sources with a questionable track record or there is limited information about the accuracy of the source.
- `medium`: Indicates that the incident information is based on sources with a mixed track record or of uncertain reliability.
- `high`: Indicates that the incident information is based on sources with a proven track record and high degree of reliability.
The `confidence` field can be used to indicate the level of trust and confidence that can be attributed to the incident, and it may impact how the incident is prioritized, analyzed and addressed. It can also help in the decision-making process associated with the incident response activities.
It is important to note that the `confidence` field is subjective and can be interpreted differently by different organizations or analysts. As such, it is often used in conjunction with other intelligence attributes, such as the `severity` field, to provide a more complete picture of the incident.'
status:
type: string
enum:
- Closed
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Closed: Merged'
- 'Closed: Near-Miss'
- 'Closed: Other'
- 'Closed: Suspected'
- 'Closed: Under Review'
- Containment Achieved
- Hold
- 'Hold: External'
- 'Hold: Internal'
- 'Hold: Legal'
- Incident Reported
- New
- 'New: Presented'
- 'New: Processing'
- Open
- 'Open: Contained'
- 'Open: Investigating'
- 'Open: Recovered'
- 'Open: Reported'
- Rejected
- Restoration Achieved
- Stalled
example: Closed
description: The `status` field represents the current state of an incident within the incident management process. Its values help in tracking and reporting the progress of the incident from its discovery to its resolution.
incident_time:
type: object
properties:
opened:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first opened.
discovered:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first discovered.
reported:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first reported.
remediated:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the remediation of the damage from the incident was completed.
closed:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was last closed.
rejected:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was first rejected.
contained:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was first contained.
required:
- opened
example:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
description: Relevant time values associated with this Incident.
meta:
type: object
additionalProperties:
type: string
example: string
x-anyOf:
- type: string
example: string
- type: number
format: double
example: 10.0
- type: string
format: date-time
example: '2016-01-01T01:01:01Z'
- type: string
example: keyword
- type: boolean
example: true
example:
keyword: string
description: metadata associated to the incident.
properties: {}
scores:
type: object
additionalProperties:
type: number
format: double
example: 10.0
description: A non-negative score number.
example:
asset: 10.0
description: Used to indicate the severity or impact score of the threat represented by the incident.
properties: {}
categories:
type: array
items:
type: string
example: Attrition
example:
- Attrition
description: A set of categories for this incident.
discovery_method:
type: string
example: Agent Disclosure
description: Identifies how the incident was discovered.
intended_effect:
type: string
example: Account Takeover
description: Specifies the suspected intended effect of this incident
assignees:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: A set of owners assigned to this incident.
detection_sources:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: A set of sources that contributed threat detections to the incident.
promotion_method:
type: string
enum:
- Automated
- Manual
example: Automated
description: Describes method for promoting an Incident, whether manually or automatically. An Incident may be created manually by a SOAR analyst or SOC operator, or through an automated correlation or aggregation rule or engine that matches a specific set of events or alerts, and promotes them to Incident(s).
detection_status:
type: string
enum:
- active
- inactive_expired
- inactive_merged
- inactive_oversized
- inactive_user_closed
example: active
description: Represents the state of an incident within the incident generation process, indicating whether the incident is actively receiving updates or is no longer being updated.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
description: "Represents the potential impact of an incident on an organization's security posture and business operations. It helps organizations prioritize and allocate resources for incident response based on the severity level of the incident \nIt helps analysts and incident handlers prioritize incidents by indicating the level of risk and potential impact associated with the incident. This enables organizations to allocate resources efficiently and address the most critical incidents first.\nCan also be used to generate reports and metrics for measuring the effectiveness of the incident response process and to identify trends and patterns in the threat landscape.\nIt is important to note that the `severity` field is subjective and can be interpreted differently by different organizations or analysts. Therefore, it should be used in conjunction with other intelligence attributes, such as the `confidence` field, to provide a more comprehensive view of the incident."
tactics:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Represents the offensive techniques, approaches, or procedures that an adversary may use to achieve their objectives during an attack. It helps in understanding the intent and capabilities of the adversary and can be used to identify indicators of attack (IoAs) or indicators of compromise (IoCs) that are associated with the adversary's tactics.
techniques:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Represents the specific methods or actions used by an attacker to carry out an offensive maneuver or achieve their goals.
short_id:
type: string
example: string
description: A human-readable, short identifier for the incident, unique within an organization.
required:
- confidence
- status
- incident_time
example:
description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
description: For submitting a new Incident.
uniqueItems: true
example:
- description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
description: a list of `NewIncident`s.
indicators:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- indicator
example: indicator
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which this Indicator is considered valid.
producer:
type: string
example: string
description: String with at most 1024 characters.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
negate:
type: boolean
example: true
description: Specifies the absence of the pattern.
indicator_type:
type: array
items:
type: string
enum:
- Anonymization
- C2
- Compromised PKI Certificate
- Domain Watchlist
- Exfiltration
- File Hash Watchlist
- Host Characteristics
- IMEI Watchlist
- IMSI Watchlist
- IP Watchlist
- Login Name
- Malicious E-mail
- Malware Artifacts
- Private Threat Feed
- URL Watchlist
example: Anonymization
example:
- Anonymization
description: Specifies the type or types for this Indicator.
tags:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Descriptors for this indicator.
composite_indicator_expression:
type: object
properties:
operator:
type: string
enum:
- and
- not
- or
example: and
indicator_ids:
type: array
items:
type: string
example: string
description: A URI leading to an indicator.
example:
- string
required:
- operator
- indicator_ids
example:
operator: and
indicator_ids:
- string
likely_impact:
type: string
example: string
description: Likely potential impact within the relevant context if this Indicator were to occur.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: level of confidence held in the accuracy of this Indicator.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: Relevant kill chain phases indicated by this Indicator.
test_mechanisms:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
specification:
type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
x-anyOf:
- type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
- type: object
properties:
type:
type: string
enum:
- ThreatBrain
example: ThreatBrain
query:
type: string
example: string
variables:
type: array
items:
type: string
example: string
example:
- string
required:
- type
- variables
example:
type: ThreatBrain
query: string
variables:
- string
description: An indicator which runs in threatbrain...
- type: object
properties:
type:
type: string
enum:
- Snort
example: Snort
snort_sig:
type: string
example: string
required:
- type
- snort_sig
example:
type: Snort
snort_sig: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- SIOC
example: SIOC
SIOC:
type: string
example: string
required:
- type
- SIOC
example:
type: SIOC
SIOC: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- OpenIOC
example: OpenIOC
open_IOC:
type: string
example: string
required:
- type
- open_IOC
example:
type: OpenIOC
open_IOC: string
description: An indicator which contains an XML blob of an openIOC indicator.
required:
- producer
example:
description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: For submitting a new Indicator
uniqueItems: true
example:
- description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: a list of `NewIndicator`s.
judgements:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- judgement
example: judgement
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
disposition:
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Matches :disposition_name as in {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}
disposition_name:
type: string
enum:
- Clean
- Common
- Malicious
- Suspicious
- Unknown
example: Clean
description: String verdict identifiers.
priority:
type: integer
format: int64
example: 10
description: A value 0-100 that determine the priority of a judgement. Curated feeds of black/white lists, for example known good products within your organizations, should use a 95. All automated systems should use a priority of 90, or less. Human judgements should have a priority of 100, so that humans can always override machines.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
reason:
type: string
example: string
description: String with at most 1024 characters.
reason_uri:
type: string
example: string
description: A URI
required:
- source
- observable
- priority
- confidence
- severity
example:
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
description: Schema for submitting new Judgements.
uniqueItems: true
example:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
description: a list of `NewJudgement`s.
malwares:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- malware
example: malware
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
labels:
type: array
items:
type: string
example: adware
description: Malware label is an open vocabulary that represents different types and functions of malware. Malware labels are not mutually exclusive; a malware instance can be both spyware and a screen capture tool.
example:
- adware
description: The type of malware being described.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: The list of Kill Chain Phases for which this Malware can be used.
x_mitre_aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Software.aliases.
abstraction_level:
type: string
enum:
- family
- variant
- version
example: family
description: Malware abstraction level.
required:
- title
- description
- short_description
- labels
example:
description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new Malware.
uniqueItems: true
example:
- description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewMalware`s.
notes:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- note
example: note
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
note_class:
type: string
example: keyword
content:
type: string
example: string
description: Markdown string with at most 5000 characters.
related_entities:
type: array
items:
type: object
properties:
entity_type:
type: string
example: string
entity_id:
type: string
example: string
description: A URI leading to an entity.
required:
- entity_type
- entity_id
example:
entity_type: string
entity_id: string
example:
- entity_type: string
entity_id: string
author:
type: string
example: string
required:
- note_class
- content
- related_entities
example:
schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
description: Schema for submitting Notes
uniqueItems: true
example:
- schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
description: a list of `NewNote`s.
relationships:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- relationship
example: relationship
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
relationship_type:
type: string
example: attributed-to
source_ref:
type: string
example: string
description: A URI leading to an entity.
target_ref:
type: string
example: string
description: A URI leading to an entity.
required:
- relationship_type
- source_ref
- target_ref
example:
description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
description: Schema for submitting new Relationships.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
description: a list of `NewRelationship`s.
sightings:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- sighting
example: sighting
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
count:
type: integer
format: int64
example: 10
description: 'The number of times an indicator was observed within a certain period of time.
For example, if an IP address associated with known malicious activity is observed once within a period of time, it may indicate a low-level threat. However, if the same IP address is observed multiple times within a short time frame, it may indicate a more severe and persistent threat.
It can also be used to prioritize security alerts and indicate the urgency of a response. High counts indicate that an indicator is actively being used in a larger campaign, while low counts may indicate isolated incidents.'
internal:
type: boolean
example: false
description: "If `true`, indicates that the sighting was reported from internal sources, such as an organization's own internal security tools or SOC.\n Internal sightings are often considered more reliable and actionable than external sightings, which are reported from external sources and may have a lower level of trustworthiness. Internal sightings can provide more context and can help identify potential threats that are unique to a particular environment or organization.\n Internal sightings can also help organizations prioritize their security response efforts by identifying threats that are specific to their environment and may not yet be widely known."
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
resolution:
type: string
example: detected
description: Represents the disposition or actions taken on the associated threat intelligence.
data:
type: object
properties:
columns:
type: array
items:
type: object
properties:
name:
type: string
example: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
example: integer
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
type: boolean
example: true
description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`.
short_description:
type: string
example: string
required:
- name
- type
example:
name: string
type: integer
description: string
required: true
short_description: string
example:
- name: string
type: integer
description: string
required: true
short_description: string
description: an ordered list of column definitions
rows:
type: array
items:
type: array
items:
example: anything
example:
- - anything
description: an ordered list of rows
row_count:
type: integer
format: int64
example: 10
description: The number of rows in the data table.
required:
- columns
- rows
example:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: An embedded data table for the Sighting.
sensor:
type: string
example: endpoint
description: The OpenC2 Actuator name that best fits the device that is creating this sighting (e.g. network.firewall)
sensor_coordinates:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
os:
type: string
example: string
required:
- type
- observables
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
description: Describes the device that made the sighting (sensor) and contains identifying observables for the sensor.
targets:
type: array
items:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
os:
type: string
example: string
required:
- type
- observables
- observed_time
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
description: Describes the target of the sighting and contains identifying observables for the target.
example:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
description: 'May include one or more targets that observed the associated indicator. Targets can include network devices, host devices, or other entities that are capable of detecting indicators of compromise.
Can be used to assess the scope of potential threats, helping analysts understand which devices or components of the network may be vulnerable to attack. For example, if a particular malware strain is detected on several different systems within an organization, the `targets` field may indicate which systems are affected and which may need to be isolated or patched to prevent further spread.'
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
description: The object(s) of interest.
relations:
type: array
items:
type: object
properties:
origin:
type: string
example: string
origin_uri:
type: string
example: string
description: A URI
relation:
type: string
example: Allocated
relation_info:
type: object
additionalProperties:
example: anything
example:
keyword: anything
properties: {}
source:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
related:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
required:
- origin
- relation
- source
- related
example:
origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
description: A relation inside a Sighting.
example:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
description: Provide any context we can about where the observable came from.
context:
type: object
properties:
process_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- ProcessCreateEvent
example: ProcessCreateEvent
process_args:
type: string
example: string
description: String with at most 2048 characters.
process_hash:
type: string
example: string
description: String with at most 2048 characters.
process_size:
type: integer
format: int64
example: 10
process_disposition:
type: string
example: string
description: String with at most 1024 characters.
parent_creation_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
parent_process_id:
type: integer
format: int64
example: 10
parent_process_guid:
type: integer
format: int64
example: 10
parent_process_name:
type: string
example: string
description: String with at most 1024 characters.
parent_process_args:
type: string
example: string
description: String with at most 2048 characters.
parent_process_username:
type: string
example: string
description: String with at most 1024 characters.
parent_process_hash:
type: string
example: string
description: String with at most 2048 characters.
parent_process_size:
type: integer
format: int64
example: 10
parent_process_disposition:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- type
example:
parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
example:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
description: a list of `ProcessCreate`
library_load_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- LibraryLoadEvent
example: LibraryLoadEvent
dll_library_name:
type: string
example: string
description: String with at most 1024 characters.
dll_library_path:
type: string
example: string
description: String with at most 2048 characters.
required:
- time
- process_id
- process_name
- type
- dll_library_name
- dll_library_path
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
description: a list of `LibraryLoadType`
file_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileCreateEvent
example: FileCreateEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileCreateType`
file_delete_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileDeleteEvent
example: FileDeleteEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileDeleteType`
file_modify_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileModifyEvent
example: FileModifyEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileModifyType`
file_move_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileMoveEvent
example: FileMoveEvent
old_name:
type: string
example: string
description: String with at most 1024 characters.
new_name:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
- old_name
- new_name
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
description: a list of `FileMoveType`
netflow_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- NetflowEvent
example: NetflowEvent
traffic:
type: object
properties:
protocol:
type: integer
format: int64
example: 10
description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
source_ip:
type: string
example: string
destination_ip:
type: string
example: string
source_port:
type: integer
format: int64
example: 10
destination_port:
type: integer
format: int64
example: 10
direction:
type: string
enum:
- incoming
- outgoing
example: incoming
destination_host_name:
type: string
example: string
source_subnet:
type: string
example: string
destination_subnet:
type: string
example: string
required:
- protocol
- source_ip
- destination_ip
- source_port
- destination_port
- direction
example:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
process_path:
type: string
example: string
description: String with at most 1024 characters.
process_args:
type: string
example: string
description: String with at most 1024 characters.
process_hash:
type: string
example: string
description: String with at most 1024 characters.
process_account_type:
type: string
example: string
description: String with at most 1024 characters.
process_account:
type: string
example: string
description: String with at most 1024 characters.
parent_process_id:
type: integer
format: int64
example: 10
parent_process_name:
type: string
example: string
description: String with at most 1024 characters.
parent_process_path:
type: string
example: string
description: String with at most 1024 characters.
parent_process_args:
type: string
example: string
description: String with at most 1024 characters.
parent_process_hash:
type: string
example: string
description: String with at most 1024 characters.
parent_process_account:
type: string
example: string
description: String with at most 1024 characters.
parent_process_account_type:
type: string
example: string
description: String with at most 1024 characters.
flow_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
byte_count_out:
type: integer
format: int64
example: 10
byte_count_in:
type: integer
format: int64
example: 10
required:
- time
- process_id
- process_name
- type
- traffic
example:
parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
example:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
description: a list of `NetflowType`
http_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- HTTPEvent
example: HTTPEvent
host:
type: string
example: string
description: String with at most 1024 characters.
traffic:
type: object
properties:
protocol:
type: integer
format: int64
example: 10
description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
source_ip:
type: string
example: string
destination_ip:
type: string
example: string
source_port:
type: integer
format: int64
example: 10
destination_port:
type: integer
format: int64
example: 10
direction:
type: string
enum:
- incoming
- outgoing
example: incoming
destination_host_name:
type: string
example: string
source_subnet:
type: string
example: string
destination_subnet:
type: string
example: string
required:
- protocol
- source_ip
- destination_ip
- source_port
- destination_port
- direction
example:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
url_port:
type: integer
format: int64
example: 10
query:
type: string
example: string
description: String with at most 5000 characters.
encrypted:
type: boolean
example: true
method:
type: string
enum:
- CONNECT
- GET
- HEAD
- OPTIONS
- PATCH
- POST
- PUT
- TRACE
example: CONNECT
required:
- time
- process_id
- process_name
- type
- host
- traffic
example:
process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
example:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
description: a list of `HTTPType`
registry_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryCreateEvent
example: RegistryCreateEvent
required:
- time
- process_id
- process_name
- registry_key
- type
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
description: a list of `RegistryCreateType`
registry_set_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistrySetEvent
example: RegistrySetEvent
registry_value:
type: string
example: string
description: String with at most 2048 characters.
registry_data_length:
type: integer
format: int64
example: 10
registry_data:
type: string
example: string
description: String with at most 5000 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
- registry_value
example:
process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
example:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
description: a list of `RegistrySetType`
registry_delete_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryDeleteEvent
example: RegistryDeleteEvent
registry_value:
type: string
example: string
description: String with at most 2048 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
description: a list of `RegistryDeleteType`
registry_rename_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryRenameEvent
example: RegistryRenameEvent
registry_old_key:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
- registry_old_key
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
description: a list of `RegistryRenameType`
example:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
description: Context including the event type that best fits the type of the sighting.
activity_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the malicious activity occurred. For example, the time when a malware sample was executing, or the time range of a network intrusion.
detection_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the malicious activity was detected by the source engine or security tool. This may differ from the activity_interval if detection occurred after the activity.
modification_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the sighting record was created or last updated in the system.
required:
- observed_time
example:
description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: For submitting a new Sighting.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: a list of `NewSighting`s.
identity_assertions:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- identity-assertion
example: identity-assertion
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
identity:
type: object
properties:
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
required:
- observables
example:
observables:
- value: 1.2.3.4
type: ip
description: Attributes for which the assertion is being made.
assertions:
type: array
items:
type: object
properties:
name:
type: string
example: cisco:ctr:ad:host_domain_name
description: An open vocabulary containing well known assertion types
value:
type: string
example: string
required:
- name
- value
example:
name: cisco:ctr:ad:host_domain_name
value: string
example:
- name: cisco:ctr:ad:host_domain_name
value: string
description: Any known context about the identity attributes.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- identity
- assertions
example:
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
description: For submitting a new IdentityAssertion.
uniqueItems: true
example:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
description: a list of `NewIdentityAssertion`s.
target_records:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- target-record
example: target-record
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
targets:
type: array
items:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
os:
type: string
example: string
description: Source Operating System where TargetRecord was originated.
internal:
type: boolean
example: false
description: Is it internal to our network?
sensor:
type: string
example: string
description: 'The OpenC2 Actuator name that best fits the device that is creating this TargetRecord (e.g.: network.firewall, etc.)'
source_uri:
type: string
example: string
description: A URI
required:
- type
- observables
- observed_time
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
description: Schema for TargetRecord Targets
example:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
required:
- source
- targets
example:
description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new TargetRecord.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewTargetRecord`s.
tools:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- tool
example: tool
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
labels:
type: array
items:
type: string
example: credential-exploitation
description: Tool labels describe the categories of tools that can be used to perform attacks.
example:
- credential-exploitation
description: The kind(s) of tool(s) being described.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: The list of kill chain phases for which this Tool can be used.
tool_version:
type: string
example: string
description: The version identifier associated with the Tool.
x_mitre_aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Software.aliases.
required:
- title
- description
- short_description
- labels
example:
description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new Tool.
uniqueItems: true
example:
- description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewTool`s.
verdicts:
type: array
items:
type: object
properties:
type:
type: string
enum:
- verdict
example: verdict
disposition:
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Numeric verdict identifiers.
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
disposition_name:
type: string
enum:
- Clean
- Common
- Malicious
- Suspicious
- Unknown
example: Clean
description: 'The disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}'
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- type
- disposition
- observable
- valid_time
example:
type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: "A Verdict is chosen from all of the Judgements on that Observable which have not yet expired. The highest priority Judgement becomes the active verdict. If there is more than one Judgement with that priority, then Clean disposition has priority over all others, then Malicious disposition, and so on down to Unknown.\n\n The ID of a verdict is a a str of the form \"observable.type:observable.value\" for example, \"ip:1.1.1.1\""
uniqueItems: true
example:
- type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: a list of `Verdict`s.
data_tables:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- data-table
example: data-table
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
columns:
type: array
items:
type: object
properties:
name:
type: string
example: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
example: integer
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
type: boolean
example: true
description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`.
short_description:
type: string
example: string
required:
- name
- type
example:
name: string
type: integer
description: string
required: true
short_description: string
example:
- name: string
type: integer
description: string
required: true
short_description: string
description: An ordered list of column definitions.
rows:
type: array
items:
type: array
items:
example: anything
example:
- - anything
description: An ordered list of rows
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
row_count:
type: integer
format: int64
example: 10
description: The number of rows in the data table.
required:
- columns
- rows
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting a NewDataTable record.
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewDataTable`s.
weaknesses:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- weakness
example: weakness
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: Should be short and limited to the key points that define this weakness.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
structure:
type: string
enum:
- Chain
- Composite
- Simple
example: Chain
description: Defines the structural nature of the weakness.
languages:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Language name (Clojure, Java, ...)
class:
type: string
example: Assembly
description: Class of language.
required:
- prevalence
example:
prevalence: Often
name: string
class: Assembly
example:
- prevalence: Often
name: string
class: Assembly
description: Applicable Languages.
operating_systems:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: String with at most 1024 characters.
version:
type: string
example: string
description: String with at most 1024 characters.
cpe_id:
type: string
example: string
description: String with at most 1024 characters.
class:
type: string
example: Android
description: Class of Operating System.
required:
- prevalence
example:
prevalence: Often
name: string
version: string
cpe_id: string
class: Android
example:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
description: Applicable operating systems.
architectures:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Architecture name (ARM, x86, ...)
class:
type: string
example: Embedded
description: Class of architecture
required:
- prevalence
example:
prevalence: Often
name: string
class: Embedded
example:
- prevalence: Often
name: string
class: Embedded
description: Applicable architectures.
paradigms:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Paradigm name (Client Server, Mainframe)
required:
- prevalence
example:
prevalence: Often
name: string
example:
- prevalence: Often
name: string
description: Applicable paradigms.
technologies:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Technology name (Web Server, Web Client)
required:
- prevalence
example:
prevalence: Often
name: string
example:
- prevalence: Often
name: string
description: Applicable technologies.
background_details:
type: string
example: string
description: Information that is relevant but not related to the nature of the weakness itself.
alternate_terms:
type: array
items:
type: object
properties:
term:
type: string
example: string
description: The actual alternate term.
description:
type: string
example: string
description: Provides context for the alternate term by which this weakness may be known.
required:
- term
example:
term: string
description: string
example:
- term: string
description: string
description: Indicates one or more other names used to describe this weakness.
modes_of_introduction:
type: array
items:
type: object
properties:
phase:
type: string
example: Architecture and Design
description: Identifies the point in the software life cycle at which the weakness may be introduced.
note:
type: string
example: string
description: Provides a typical scenario related to introduction during the given phase.
required:
- phase
example:
phase: Architecture and Design
note: string
example:
- phase: Architecture and Design
note: string
description: Information about how and when a given weakness may be introduced.
likelihood:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Likelihood of exploit.
common_consequences:
type: array
items:
type: object
properties:
scopes:
type: array
items:
type: string
example: Access Control
description: Defines the different areas of software security that can be affected by exploiting a weakness.
example:
- Access Control
description: Identifies the security property that is violated.
impacts:
type: array
items:
type: string
example: Alter Execution Logic
example:
- Alter Execution Logic
description: Describes the technical impact that arises if an adversary succeeds in exploiting this weakness.
likelihood:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: How likely the specific consequence is expected to be seen relative to the other consequences.
note:
type: string
example: string
description: Additional commentary about a consequence.
required:
- scopes
example:
scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
example:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
description: Refers to the typical or expected negative effects that can result from exploiting the weakness. This could include anything from unauthorized access to data, denial of service, system crashes or other things.
detection_methods:
type: array
items:
type: object
properties:
method:
type: string
example: Architecture or Design Review
description: Identifies the particular detection method being described.
description:
type: string
example: string
description: Provides some context of how this method can be applied to a specific weakness.
effectiveness:
type: string
example: High
description: How effective the detection method may be in detecting the associated weakness.
effectiveness_notes:
type: string
example: string
description: Provides additional discussion of the strengths and shortcomings of this detection method.
required:
- method
- description
example:
method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
example:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
description: Identifies methods that may be employed to detect this weakness, including their strengths and limitations.
potential_mitigations:
type: array
items:
type: object
properties:
description:
type: string
example: string
description: A description of this individual mitigation including any strengths and shortcomings of this mitigation for the weakness.
phases:
type: array
items:
type: string
example: Architecture and Design
description: Defines the different regularities that guide the applicability of platforms.
example:
- Architecture and Design
description: Indicates the development life cycle phase during which this particular mitigation may be applied.
strategy:
type: string
example: Attack Surface Reduction
description: A general strategy for protecting a system to which this mitigation contributes.
effectiveness:
type: string
example: Defense in Depth
description: Summarizes how effective the mitigation may be in preventing the weakness.
effectiveness_notes:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
- description
example:
description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
example:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
description: Describes potential mitigations associated with a weakness.
functional_areas:
type: array
items:
type: string
example: Authentication
description: Defines the different functional areas of software in which the weakness may appear.
example:
- Authentication
description: Identifies the functional area of the software in which the weakness is most likely to occur.
affected_resources:
type: array
items:
type: string
example: CPU
description: Defines a resource of a system.
example:
- CPU
description: Identifies system resources that can be affected by an exploit of this weakness.
notes:
type: array
items:
type: object
properties:
type:
type: string
example: Applicable Platform
description: Defines the different types of notes that can be associated with a weakness.
note:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
- type
- note
example:
type: Applicable Platform
note: string
example:
- type: Applicable Platform
note: string
description: Provides any additional comments about the weakness.
abstraction_level:
type: string
enum:
- Base
- Class
- Compound
- Variant
example: Base
description: Refers to the level of abstraction or granularity used to describe the weakness. It helps to categorize the vulnerability based on the level of detail provided.
required:
- description
example:
description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
description: For submitting a new weakness.
uniqueItems: true
example:
- description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
description: a list of `NewWeakness`s.
vulnerabilities:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- vulnerability
example: vulnerability
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: "Various sources of vulnerability information can be used, including third-party resources like the National Vulnerability Database (NVD) and the Common Vulnerabilities and Exposures (CVE) database. The platform then analyzes this data and provides the user with relevant details such as the severity of the vulnerability, the affected systems, and remediation recommendations. \n\n Based on this information, the user can prioritize patching and other mitigation strategies to reduce the risk of potential attacks."
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
cve:
type: object
properties:
cve_data_meta:
type: object
properties:
id:
type: string
example: string
description: String with at most 1024 characters.
assigner:
type: string
example: string
description: String with at most 1024 characters.
example:
id: string
assigner: string
required:
- cve_data_meta
example:
cve_data_meta:
id: string
assigner: string
impact:
type: object
properties:
cvss_v2:
type: object
properties:
vector_string:
type: string
example: string
description: a text representation of a set of CVSSv2 metrics. It is commonly used to record or transfer CVSSv2 metric information in a concise form
base_score:
type: number
format: double
example: 10.0
description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v2/guide'
base_severity:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
impact_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
exploitability_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
access_vector:
type: string
enum:
- adjacent network
- local
- network
example: network
description: This metric reflects how the vulnerability is exploited.The more remote an attacker can be to attack a host, the greater the vulnerability score.
access_complexity:
type: string
enum:
- high
- low
- medium
example: low
description: 'This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system. For example, consider a buffer overflow in an Internet service: once the target system is located, the attacker can launch an exploit at will.'
authentication:
type: string
enum:
- multiple
- none
- single
example: none
description: This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. This metric does not gauge the strength or complexity of the authentication process, only that an attacker is required to provide credentials before an exploit may occur. The fewer authentication instances that are required, the higher the vulnerability score.
confidentiality_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact on confidentiality of a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. Increasedconfidentiality impact increases the vulnerability score.
integrity_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information. Increased integrity impact increases the vulnerability score.
availability_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact to availability of a successfully exploited vulnerability. Availability refers to the accessibility of information resources. Attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system. Increased availability impact increases the vulnerability score.
exploitability:
type: string
enum:
- functional
- high
- not_defined
- proof_of_concept
- unproven
example: not_defined
description: This metric measures the current state of exploit techniques or code availability. Public availability of easy-to-use exploit code increases the number of potential attackers by including those who are unskilled thereby increasing the severity of the vulnerability.
remediation_level:
type: string
enum:
- not_defined
- official_fix
- temporary_fix
- unavailable
- workaround
example: not_defined
description: The remediation level of a vulnerability is an important factor for prioritization. The typical vulnerability is unpatched when initially published. Workarounds or hotfixes may offer interim remediation until an official patch or upgrade is issued. Each of these respective stages adjusts the temporal score downwards, reflecting the decreasing urgency as remediation becomes final. The less official and permanent a fix, the higher the vulnerability score is.
report_confidence:
type: string
enum:
- confirmed
- not_defined
- unconfirmed
- uncorroborated
example: not_defined
description: This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details. Sometimes, only the existence of vulnerabilities are publicized, but without specific details. The vulnerability may later be corroborated and then confirmed through acknowledgement by the author or vendor of the affected technology. The urgency of a vulnerability is higher when a vulnerability is known to exist with certainty. This metric also suggests the level of technical knowledge available to would-be attackers. The more a vulnerability is validated by the vendor or other reputable sources, the higher the score.
temporal_vector_string:
type: string
example: string
description: A text representation of a set of CVSSv2 temporal metrics. Temporal metrics allow analysists to calculate threat severity based on temporal factors such as reliability of vulnerability reports, availability of mitigations, and the ease or difficulty of conducting the exploit. It is commonly used to record or transfer CVSSv2 metric information in a concise form
collateral_damage_potential:
type: string
enum:
- high
- low
- low_medium
- medium_high
- none
- not_defined
example: not_defined
description: This metric measures the potential for loss of life or physical assets through damage or theft of property or equipment. The metric may also measure economic loss of productivity or revenue. Naturally, the greater the damage potential, the higher the vulnerability score.
target_distribution:
type: string
enum:
- high
- low
- medium
- none
- not_defined
example: not_defined
description: This metric measures the proportion of vulnerable systems. It is meant as an environment-specific indicator in order to approximate the percentage of systems that could be affected by the vulnerability. The greater the proportion of vulnerable systems, the higher the score.
confidentiality_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
integrity_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
availability_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
environmental_vector_string:
type: string
example: string
description: A text representation of a set of CVSSv2 environmental metrics. Environmental metrics allow analysists to calculate threat scores in relation to environmental security requirements, collateral damage potential, and target availability. It is commonly used to record or transfer CVSSv2 metric information in a concise form
obtain_all_privilege:
type: boolean
example: true
obtain_user_privilege:
type: boolean
example: true
obtain_other_privilege:
type: boolean
example: true
user_interaction_required:
type: boolean
example: true
required:
- vector_string
- base_score
- base_severity
example:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
type: object
properties:
vector_string:
type: string
example: string
description: a text representation of a set of CVSSv3 metrics. It is commonly used to record or transfer CVSSv3 metric information in a concise form
base_score:
type: number
format: double
example: 10.0
description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v3-1'
base_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
impact_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
exploitability_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
attack_vector:
type: string
enum:
- adjacent_network
- local
- network
- physical
example: adjacent_network
description: Reflects the context by which vulnerability exploitation is possible
modified_attack_vector:
type: string
enum:
- adjacent_network
- local
- network
- not_defined
- physical
example: not_defined
description: modified attack vector
attack_complexity:
type: string
enum:
- high
- low
example: high
description: describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability
modified_attack_complexity:
type: string
enum:
- high
- low
- not_defined
example: not_defined
description: modified attack complexity
privileges_required:
type: string
enum:
- high
- low
- none
example: high
description: describes the level of privileges an attacker must possess before successfully exploiting the vulnerability
modified_privileges_required:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified privileges required
user_interaction:
type: string
enum:
- none
- required
example: none
description: captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component
modified_user_interaction:
type: string
enum:
- none
- not_defined
- required
example: none
description: modified user interaction
scope:
type: string
enum:
- changed
- unchanged
example: changed
description: the ability for a vulnerability in one software component to impact resources beyond its means, or privileges
modified_scope:
type: string
enum:
- changed
- not_defined
- unchanged
example: not_defined
description: modified scope
confidentiality_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability
modified_confidentiality_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified confidentiality impact
integrity_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to integrity of a successfully exploited vulnerability
modified_integrity_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified integrity impact
availability_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability
modified_availability_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified availability impact
exploit_code_maturity:
type: string
enum:
- functional
- high
- not_defined
- proof_of_concept
- unproven
example: functional
description: measures the likelihood of the vulnerability being attacked
remediation_level:
type: string
enum:
- high
- not_defined
- offical_fix
- temporary_fix
- unavailable
- workaround
example: high
description: Remediation Level of a vulnerability is an important factor for prioritization
report_confidence:
type: string
enum:
- confirmed
- reasonable
- unknown
example: confirmed
description: measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details
temporal_score:
type: number
format: double
example: 10.0
description: Round up(CVSSv3BaseScore × CVSSv3ExploitCodeMaturity × CVSSv3RemediationLevel × CVSSv3ReportConfidence)
temporal_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
description: temporal severity
availability_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
confidentiality_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
integrity_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
environmental_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
environmental_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
required:
- vector_string
- base_score
- base_severity
example:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
example:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: "Describes the potential impact of a vulnerability that is being tracked in the system. Provides information on the extent of damage that a vulnerability can cause and how serious the consequences could be if it is exploited. \n\nMay contain granular information about the vulnerability severity using the CVSS system, versions 2 and 3.\n\nCVSSv2 and CVSSv3 have different methods of calculating base scores, but both are designed to provide an indication of the level of risk that a vulnerability poses. The base score ranges from 0 to 10, with 10 being the most severe. Additionally, both CVSSv2 and CVSSv3 define severity levels, such as low, medium, high, and critical, based on the base score."
configurations:
type: object
properties:
CVE_data_version:
type: string
example: string
description: Specifies the version of the CVE (Common Vulnerabilities and Exposures) dictionary used by the vulnerability information provider.
nodes:
type: array
items:
type: object
properties:
operator:
type: string
enum:
- AND
- OR
example: AND
description: The operator string influences how seqs of cpe matches are related to one another.
cpe_match:
type: array
items:
type: object
properties:
vulnerable:
type: boolean
example: true
cpe23Uri:
type: string
example: string
description: A text representation of a software or hardware platform.
versionStartIncluding:
type: string
example: string
description: A string representing the lower bound(inclusive) of version in the CPE.
versionEndIncluding:
type: string
example: string
description: A string representing the upper bound(inclusive) of version in the CPE.
versionStartExcluding:
type: string
example: string
description: A string representing the lower bound(exclusive) of version in the CPE.
versionEndExcluding:
type: string
example: string
description: A string representing the upper bound(exclusive) of version in the CPE.
required:
- vulnerable
- cpe23Uri
example:
vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
example:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
type: array
items:
type: object
properties:
operator:
type: string
enum:
- AND
- OR
example: AND
description: The operator string influences how seqs of cpe matches are related to one another.
cpe_match:
type: array
items:
type: object
properties:
vulnerable:
type: boolean
example: true
cpe23Uri:
type: string
example: string
description: A text representation of a software or hardware platform.
versionStartIncluding:
type: string
example: string
description: A string representing the lower bound(inclusive) of version in the CPE.
versionEndIncluding:
type: string
example: string
description: A string representing the upper bound(inclusive) of version in the CPE.
versionStartExcluding:
type: string
example: string
description: A string representing the lower bound(exclusive) of version in the CPE.
versionEndExcluding:
type: string
example: string
description: A string representing the upper bound(exclusive) of version in the CPE.
required:
- vulnerable
- cpe23Uri
example:
vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
example:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate:
type: boolean
example: true
description: Negates operator when true.
required:
- operator
- cpe_match
example:
operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
example:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate:
type: boolean
example: true
description: Negates operator when true.
required:
- operator
example:
operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
example:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
description: Each `node` in the CTIM standard configuration includes information such as the `operator` (such as "less than", or "greater than or equal to"), and the `cpe` (Common Platform Enumeration) string which identifies the specific software, `CPE` is a structured naming scheme for IT systems, platforms, and software packages, and it is instrumental in enabling data exchange between different systems.
required:
- CVE_data_version
- nodes
example:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
description: "Represents a list of affected versions or configurations of a software component that is impacted by a vulnerability. \nBy tracking the affected software components and versions, defenders can identify which systems are potentially exposed to an attack, and apply appropriate mitigations."
published_date:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: "Represents the date when a vulnerability was publicly disclosed or made available to the general public. \n\nImportant for tracking the age of a vulnerability, as well as for determining when a particular vulnerability was first introduced into a system. The published date can be used to identify the time window during which a system may have been vulnerable to a particular exploit.\n\nFor example, if an organization discovers that a vulnerability was published before their system's installation date, but they did not apply the necessary security updates in a timely manner, it can be concluded that their system was vulnerable for the period between the installation date and the date when the necessary security updates were applied."
last_modified_date:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: 'Represents the date when the vulnerability metadata was last updated in the internal database.
It can be used to track the freshness of the vulnerability information. If the `last_modified_date` is more recent than the `published_date`, it can indicate that there has been some new information or updates related to the vulnerability, such as new patch releases or changes in the severity or impact rating.'
required:
- description
example:
description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: For submitting a new vulnerability.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: a list of `NewVulnerability`s.
actor_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_mapping_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_properties_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
attack_pattern_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
campaign_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
coa_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
feedback_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
identity_assertion_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
incident_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
indicator_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
judgement_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
malware_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
note_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
relationship_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
sighting_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
target_record_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
tool_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
verdict_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
data_table_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
weakness_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
vulnerability_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- source
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
asset_mapping_refs:
- string
note_refs:
- string
data_table_refs:
- string
attack_pattern_refs:
- string
sighting_refs:
- string
schema_version: 1.3.30
revision: 10
assets:
- description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
weakness_refs:
- string
tool_refs:
- string
target_record_refs:
- string
asset_refs:
- string
tools:
- description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
indicators:
- description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
attack_patterns:
- description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
type: bundle
weaknesses:
- description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
source: string
external_ids:
- string
feedback_refs:
- string
asset_properties:
- properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
short_description: string
feedbacks:
- feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
judgement_refs:
- string
title: string
coa_refs:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
verdicts:
- type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
campaigns:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
source_uri: string
actors:
- description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
indicator_refs:
- string
actor_refs:
- string
language: string
data_tables:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
id: string
notes:
- schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
identity_assertions:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
judgements:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
malwares:
- description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
target_records:
- description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
asset_mappings:
- asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
relationship_refs:
- string
tlp: green
incidents:
- description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
identity_assertion_refs:
- string
sightings:
- description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
campaign_refs:
- string
vulnerability_refs:
- string
asset_properties_refs:
- string
relationships:
- description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
timestamp: '2016-01-01T01:01:01Z'
verdict_refs:
- string
malware_refs:
- string
incident_refs:
- string
vulnerabilities:
- description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
coas:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: Describes a Bundle of any set of CTIM entities.
investigated_observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
required:
- bundle
application/transit+json:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- bundle
example: bundle
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
actors:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- actor
example: actor
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Indicates the time span for which the information about the Actor is relevant, and after which it could become outdated.
actor_types:
type: array
items:
type: string
example: Cyber Espionage Operations
example:
- Cyber Espionage Operations
identity:
type: object
properties:
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
related_identities:
type: array
items:
type: object
properties:
identity:
type: string
example: string
description: The reference (URI) of the related Identity object.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Specifies the level of confidence in the assertion of the relationship between the two objects.
information_source:
type: string
example: string
description: Specifies the source of the information about the relationship between the two components.
relationship:
type: string
example: string
required:
- identity
example:
identity: string
confidence: High
information_source: string
relationship: string
description: Describes a related Identity
example:
- identity: string
confidence: High
information_source: string
relationship: string
description: Identifies other entity Identities related to this Identity.
required:
- description
- related_identities
example:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
description: Can contain information such as the name of the attacker, the group or organization they belong to, or any other identifier that can help in the attribution process.
motivation:
type: string
example: Ego
description: The reason or purpose behind the malicious activity attributed to this Actor. By understanding a threat actor's motivation, analysts can better predict the attacker's behavior and anticipate future malicious actions.
sophistication:
type: string
enum:
- Aspirant
- Expert
- Innovator
- Novice
- Practitioner
example: Aspirant
description: "Represents the level of expertise and skill that the threat actor has displayed in their malicious activities. Can help security analysts assess the potential impact of an attacker's TTPs and determine the potential attack surface. \n\nFor example, a threat actor with a low sophistication level may primarily rely on off-the-shelf malware and attack tools, while an attacker with high sophistication may use custom tools with advanced evasion techniques, zero-day exploits, and sophisticated methods for command and control of their malware. \n\nThe sophistication level of an attacker can also be inferred based on several factors such as the complexity of attacks, the attacker's knowledge of the targeted organization's systems, and the attacker's ability to remain undetected.\n\nIf an attacker shows a high level of sophistication in reconnaissances, social engineering, and phishing, then the attacker may have a good knowledge of the targeted organization and its employees. This means that the attacker may be more successful in infiltrating the organization's network and compromising its systems."
intended_effect:
type: string
example: Account Takeover
description: "Represents the desired outcome or impact the threat actor is trying to achieve through their malicious activities. \n\n Helps security analysts to understand the attacker's goals beyond the immediate impact of the attack. By understanding the intended effect, analysts can draw connections between seemingly unrelated attacks and build a more complete understanding of an attacker's long-term goals and motivations."
planning_and_operational_support:
type: string
example: string
description: "Provides information about the resources and capabilities of the attacker that could be used to assist in planning and operations related to the threat.\n\n It can be used to describe Infrastructure, Tools, Techniques, and Capabilities used by the threat actor."
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'This field can help analysts decide how much trust they can put in the information provided by the threat intelligence sources.
For example, an Actor entity can have high confidence if the organization''s security researchers have been tracking it for a long time and have gathered a significant amount of intelligence about it through various sources, such as analysis of malware, network traffic, and human intelligence. In contrast, low confidence may indicate the organization has only seen limited or circumstantial evidence.'
aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: A list of other names that this Threat Actor is believed to use.
required:
- source
- title
- description
- short_description
example:
description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
description: Schema for submitting new Actors
uniqueItems: true
example:
- description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
description: a list of `NewActor`s.
assets:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset
example: asset
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: 'Specifies the time range during which the asset is considered valid or accurate.
For example, if an asset entity represents a device, the `valid_time` field could be used to indicate the period during which the device''s configuration information is deemed accurate.'
asset_type:
type: string
enum:
- application
- data
- device
- network
- person
example: application
description: 'Type of the Asset: Device, Person, Application, etc.'
required:
- source
- valid_time
- asset_type
example:
description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new Assets
uniqueItems: true
example:
- description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAsset`s.
asset_mappings:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset-mapping
example: asset-mapping
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: For each asset, we allow for the assertion of time bound properties.This gives us both a record of the current state of the asset,as well as history.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'Level of confidence held in the characterization of this AssetMapping e.g.: is it susceptible to manipulation or translation?'
specificity:
type: string
enum:
- Low
- Medium
- Unique
example: Low
description: Denotes the level of how many assets potentially could have this same identifier.
stability:
type: string
enum:
- Managed
- Physical
- Temporary
example: Managed
description: Do we manage when it changes, or is it always a time bound assignment?
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: An AssetMapping is a record that a specific Observable maps to an Asset for an indicated period of time.
asset_ref:
type: string
example: string
description: URI that points to the mapped Asset.
asset_type:
type: string
enum:
- application
- data
- device
- network
- person
example: application
description: 'Type of the mapped Asset: Device, Person, Application, etc.'
required:
- source
- valid_time
- confidence
- specificity
- stability
- observable
- asset_ref
- asset_type
example:
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
description: Schema for submitting new AssetMapping.
uniqueItems: true
example:
- asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
description: a list of `NewAssetMapping`s.
asset_properties:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset-properties
example: asset-properties
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which the AssetProperties is considered valid.
asset_ref:
type: string
example: string
description: URI that points to the associated Asset.
properties:
type: array
items:
type: object
properties:
name:
type: string
example: string
description: The properties are an open vocabulary.
value:
type: string
example: string
required:
- name
- value
example:
name: string
value: string
example:
- name: string
value: string
required:
- source
- valid_time
- asset_ref
example:
properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new AssetProperties
uniqueItems: true
example:
- properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAssetProperties`s.
attack_patterns:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- attack-pattern
example: attack-pattern
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: A kill chain is a series of steps that an attacker must go through to successfully achieve their objective. The concept was originally developed by the military, but has been adapted to the cybersecurity field to describe the steps an attacker goes through to compromise a target system and achieve their goal.
x_mitre_data_sources:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Data Sources.
x_mitre_platforms:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Platforms.
x_mitre_contributors:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Contributors.
abstraction_level:
type: string
enum:
- aggregate
- category
- detailed
- meta
- standard
example: aggregate
description: The CAPEC abstraction level for patterns describing techniques to attack a system.
required:
- title
- description
- short_description
example:
description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new AttackPattern
uniqueItems: true
example:
- description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAttackPattern`s.
campaigns:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- campaign
example: campaign
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Timestamp for the definition of a specific version of a campaign.
campaign_type:
type: string
example: string
description: 'String value that describes the type of campaign. For example, a campaign type could be ''Ransomware'', ''Advanced Persistent Threat'', ''Business Email Compromise'', ''Phishing'', etc. '
names:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Used to capture alternate names or aliases associated with the campaign. A cyberattack campaign may have multiple names or aliases depending on the group or actor(s) behind the attack, e.g., 'Wannacry' is also known as 'WannaCrypt', 'WCry', 'Wanna Decryptor', etc.
intended_effect:
type: array
items:
type: string
example: Account Takeover
example:
- Account Takeover
description: Characterizes the intended effect of this cyber threat campaign.
status:
type: string
enum:
- Future
- Historic
- Ongoing
example: Future
description: "Indicates current Status of the Campaign. \n\nCan have one of the following values: \n\n- Ongoing: Indicates that the campaign is currently active and ongoing. For example, a mass phishing campaign that is actively targeting users is considered 'ongoing'.\n\n- Historic: Campaign has already occurred and is now in the past.\n\n- Future: This indicates that a campaign is planned or expected to occur in the future. For example, a threat actor may announce their intention to launch a specific cyberattack campaign at a future date."
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Level of confidence held in the characterization of this Campaign.
activity:
type: array
items:
type: object
properties:
date_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Specifies the date and time at which the activity occured.
description:
type: string
example: string
description: A description of the activity.
required:
- date_time
- description
example:
date_time: '2016-01-01T01:01:01Z'
description: string
description: Captures the specific activities or tactics associated with the entity. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc.
example:
- date_time: '2016-01-01T01:01:01Z'
description: string
description: 'Used to capture specific activities or tactics associated with the campaign.
The ''activity'' field is an array of objects, and each element represents a specific activity and time associated with the campaign. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc. By capturing these activities analysts can identify the specific tactics used by the threat actor(s) behind the campaign.'
required:
- title
- description
- short_description
- campaign_type
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
description: Schema for submitting new Campaigns
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
description: a list of `NewCampaign`s.
coas:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- coa
example: coa
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
stage:
type: string
enum:
- Containment
- Eradication
- Identification
- Lessons Learned
- Preparation
- Recovery
- Remedy
- Response
example: Containment
description: Specifies what stage in the cyber threat management lifecycle this Course Of Action is relevant to.
coa_type:
type: string
enum:
- Diplomatic Actions
- Eradication
- Hardening
- Internal Blocking
- Logical Access Restrictions
- Monitoring
- Other
- Patching
- Perimeter Blocking
- Phase
- Physical Access Restrictions
- Playbook
- Policy Actions
- Public Disclosure
- Rebuilding
- Redirection
- Redirection (Honey Pot)
- Task
- Training
example: Diplomatic Actions
description: The type of this COA
objective:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Characterizes the objective to provide guidance on how to mitigate a security incident that has been identified.
impact:
type: string
example: string
description: Characterizes the estimated impact of applying this course of action.
cost:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Characterizes the estimated cost for applying this course of action.
efficacy:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Effectiveness of this course of action in achieving its targeted objective.
related_COAs:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
COA_id:
type: string
example: string
description: A URI leading to a COA.
required:
- COA_id
example:
confidence: High
source: string
relationship: string
COA_id: string
example:
- confidence: High
source: string
relationship: string
COA_id: string
description: Identifies or characterizes relationships to one or more related courses of action.
structured_coa_type:
type: string
enum:
- openc2
example: openc2
open_c2_coa:
type: object
properties:
type:
type: string
enum:
- structured_coa
example: structured_coa
id:
type: string
example: string
description: String with at most 1024 characters.
action:
type: object
properties:
type:
type: string
enum:
- alert
- allow
- augment
- contain
- delete
- deny
- detonate
- distill
- get
- investigate
- locate
- mitigate
- modify
- move
- notify
- other
- pause
- query
- redirect
- remediate
- report
- response
- restart
- restore
- resume
- save
- scan
- set
- snapshot
- start
- stop
- substitute
- sync
- throttle
- update
example: alert
required:
- type
example:
type: alert
target:
type: object
properties:
type:
type: string
example: acudid
specifiers:
type: string
example: string
description: Observable types that can be acted upon.
required:
- type
example:
type: acudid
specifiers: string
actuator:
type: object
properties:
type:
type: string
enum:
- endpoint
- endpoint.digital-telephone-handset
- endpoint.laptop
- endpoint.pos-terminal
- endpoint.printer
- endpoint.sensor
- endpoint.server
- endpoint.smart-meter
- endpoint.smart-phone
- endpoint.tablet
- endpoint.workstation
- network
- network.bridge
- network.firewall
- network.gateway
- network.guard
- network.hips
- network.hub
- network.ids
- network.ips
- network.modem
- network.nic
- network.proxy
- network.router
- network.security_manager
- network.sense_making
- network.sensor
- network.switch
- network.vpn
- network.wap
- other
- process
- process.aaa-server
- process.anti-virus-scanner
- process.connection-scanner
- process.directory-service
- process.dns-server
- process.email-service
- process.file-scanner
- process.location-service
- process.network-scanner
- process.remediation-service
- process.reputation-service
- process.sandbox
- process.virtualization-service
- process.vulnerability-scanner
example: endpoint
specifiers:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: List of additional properties describing the actuator.
required:
- type
example:
type: endpoint
specifiers:
- string
modifiers:
type: object
properties:
delay:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
duration:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
frequency:
type: string
example: string
description: String with at most 1024 characters.
id:
type: string
example: string
description: String with at most 1024 characters.
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
response:
type: string
enum:
- acknowledge
- command-ref
- query
- status
example: acknowledge
source:
type: string
example: string
description: String with at most 1024 characters.
destination:
type: string
enum:
- copy-to
- modify-to
- move-to
- report-to
- restore-point
- save-to
- set-to
example: copy-to
method:
type: array
items:
type: string
enum:
- acl
- authenticated
- blackhole
- blacklist
- graceful
- hibernate
- honeypot
- immediate
- segmentation
- spawn
- suspend
- unauthenticated
- whitelist
example: acl
example:
- acl
search:
type: string
enum:
- cve
- patch
- signature
- vendor_bulletin
example: cve
location:
type: string
enum:
- internal
- perimeter
example: internal
option:
type: string
example: string
description: String with at most 1024 characters.
additional_properties:
type: object
properties:
context:
type: string
example: string
description: String with at most 1024 characters.
required:
- context
example:
context: string
example:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
required:
- type
- action
example:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: Schema for submitting new COAs
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: a list of `NewCOA`s.
feedbacks:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- feedback
example: feedback
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
entity_id:
type: string
example: string
description: A URI leading to an entity.
feedback:
type: integer
enum:
- -1
- 0
- 1
example: -1
reason:
type: string
example: string
required:
- entity_id
- feedback
- reason
example:
feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new Feedback.
uniqueItems: true
example:
- feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewFeedback`s.
incidents:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- incident
example: incident
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'Represents the level of certainty or trustworthiness associated with the incident. It denotes the reliability of the intelligence associated with the incident.
The `confidence` field can take on several values, including:
- `info`: Indicates that the incident information is based on sources with no previous track record or there is no track record for the source reporting the incident.
- `low`: Indicates that the incident information is based on sources with a questionable track record or there is limited information about the accuracy of the source.
- `medium`: Indicates that the incident information is based on sources with a mixed track record or of uncertain reliability.
- `high`: Indicates that the incident information is based on sources with a proven track record and high degree of reliability.
The `confidence` field can be used to indicate the level of trust and confidence that can be attributed to the incident, and it may impact how the incident is prioritized, analyzed and addressed. It can also help in the decision-making process associated with the incident response activities.
It is important to note that the `confidence` field is subjective and can be interpreted differently by different organizations or analysts. As such, it is often used in conjunction with other intelligence attributes, such as the `severity` field, to provide a more complete picture of the incident.'
status:
type: string
enum:
- Closed
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Closed: Merged'
- 'Closed: Near-Miss'
- 'Closed: Other'
- 'Closed: Suspected'
- 'Closed: Under Review'
- Containment Achieved
- Hold
- 'Hold: External'
- 'Hold: Internal'
- 'Hold: Legal'
- Incident Reported
- New
- 'New: Presented'
- 'New: Processing'
- Open
- 'Open: Contained'
- 'Open: Investigating'
- 'Open: Recovered'
- 'Open: Reported'
- Rejected
- Restoration Achieved
- Stalled
example: Closed
description: The `status` field represents the current state of an incident within the incident management process. Its values help in tracking and reporting the progress of the incident from its discovery to its resolution.
incident_time:
type: object
properties:
opened:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first opened.
discovered:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first discovered.
reported:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first reported.
remediated:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the remediation of the damage from the incident was completed.
closed:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was last closed.
rejected:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was first rejected.
contained:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was first contained.
required:
- opened
example:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
description: Relevant time values associated with this Incident.
meta:
type: object
additionalProperties:
type: string
example: string
x-anyOf:
- type: string
example: string
- type: number
format: double
example: 10.0
- type: string
format: date-time
example: '2016-01-01T01:01:01Z'
- type: string
example: keyword
- type: boolean
example: true
example:
keyword: string
description: metadata associated to the incident.
properties: {}
scores:
type: object
additionalProperties:
type: number
format: double
example: 10.0
description: A non-negative score number.
example:
asset: 10.0
description: Used to indicate the severity or impact score of the threat represented by the incident.
properties: {}
categories:
type: array
items:
type: string
example: Attrition
example:
- Attrition
description: A set of categories for this incident.
discovery_method:
type: string
example: Agent Disclosure
description: Identifies how the incident was discovered.
intended_effect:
type: string
example: Account Takeover
description: Specifies the suspected intended effect of this incident
assignees:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: A set of owners assigned to this incident.
detection_sources:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: A set of sources that contributed threat detections to the incident.
promotion_method:
type: string
enum:
- Automated
- Manual
example: Automated
description: Describes method for promoting an Incident, whether manually or automatically. An Incident may be created manually by a SOAR analyst or SOC operator, or through an automated correlation or aggregation rule or engine that matches a specific set of events or alerts, and promotes them to Incident(s).
detection_status:
type: string
enum:
- active
- inactive_expired
- inactive_merged
- inactive_oversized
- inactive_user_closed
example: active
description: Represents the state of an incident within the incident generation process, indicating whether the incident is actively receiving updates or is no longer being updated.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
description: "Represents the potential impact of an incident on an organization's security posture and business operations. It helps organizations prioritize and allocate resources for incident response based on the severity level of the incident \nIt helps analysts and incident handlers prioritize incidents by indicating the level of risk and potential impact associated with the incident. This enables organizations to allocate resources efficiently and address the most critical incidents first.\nCan also be used to generate reports and metrics for measuring the effectiveness of the incident response process and to identify trends and patterns in the threat landscape.\nIt is important to note that the `severity` field is subjective and can be interpreted differently by different organizations or analysts. Therefore, it should be used in conjunction with other intelligence attributes, such as the `confidence` field, to provide a more comprehensive view of the incident."
tactics:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Represents the offensive techniques, approaches, or procedures that an adversary may use to achieve their objectives during an attack. It helps in understanding the intent and capabilities of the adversary and can be used to identify indicators of attack (IoAs) or indicators of compromise (IoCs) that are associated with the adversary's tactics.
techniques:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Represents the specific methods or actions used by an attacker to carry out an offensive maneuver or achieve their goals.
short_id:
type: string
example: string
description: A human-readable, short identifier for the incident, unique within an organization.
required:
- confidence
- status
- incident_time
example:
description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
description: For submitting a new Incident.
uniqueItems: true
example:
- description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
description: a list of `NewIncident`s.
indicators:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- indicator
example: indicator
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which this Indicator is considered valid.
producer:
type: string
example: string
description: String with at most 1024 characters.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
negate:
type: boolean
example: true
description: Specifies the absence of the pattern.
indicator_type:
type: array
items:
type: string
enum:
- Anonymization
- C2
- Compromised PKI Certificate
- Domain Watchlist
- Exfiltration
- File Hash Watchlist
- Host Characteristics
- IMEI Watchlist
- IMSI Watchlist
- IP Watchlist
- Login Name
- Malicious E-mail
- Malware Artifacts
- Private Threat Feed
- URL Watchlist
example: Anonymization
example:
- Anonymization
description: Specifies the type or types for this Indicator.
tags:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Descriptors for this indicator.
composite_indicator_expression:
type: object
properties:
operator:
type: string
enum:
- and
- not
- or
example: and
indicator_ids:
type: array
items:
type: string
example: string
description: A URI leading to an indicator.
example:
- string
required:
- operator
- indicator_ids
example:
operator: and
indicator_ids:
- string
likely_impact:
type: string
example: string
description: Likely potential impact within the relevant context if this Indicator were to occur.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: level of confidence held in the accuracy of this Indicator.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: Relevant kill chain phases indicated by this Indicator.
test_mechanisms:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
specification:
type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
x-anyOf:
- type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
- type: object
properties:
type:
type: string
enum:
- ThreatBrain
example: ThreatBrain
query:
type: string
example: string
variables:
type: array
items:
type: string
example: string
example:
- string
required:
- type
- variables
example:
type: ThreatBrain
query: string
variables:
- string
description: An indicator which runs in threatbrain...
- type: object
properties:
type:
type: string
enum:
- Snort
example: Snort
snort_sig:
type: string
example: string
required:
- type
- snort_sig
example:
type: Snort
snort_sig: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- SIOC
example: SIOC
SIOC:
type: string
example: string
required:
- type
- SIOC
example:
type: SIOC
SIOC: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- OpenIOC
example: OpenIOC
open_IOC:
type: string
example: string
required:
- type
- open_IOC
example:
type: OpenIOC
open_IOC: string
description: An indicator which contains an XML blob of an openIOC indicator.
required:
- producer
example:
description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: For submitting a new Indicator
uniqueItems: true
example:
- description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: a list of `NewIndicator`s.
judgements:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- judgement
example: judgement
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
disposition:
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Matches :disposition_name as in {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}
disposition_name:
type: string
enum:
- Clean
- Common
- Malicious
- Suspicious
- Unknown
example: Clean
description: String verdict identifiers.
priority:
type: integer
format: int64
example: 10
description: A value 0-100 that determine the priority of a judgement. Curated feeds of black/white lists, for example known good products within your organizations, should use a 95. All automated systems should use a priority of 90, or less. Human judgements should have a priority of 100, so that humans can always override machines.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
reason:
type: string
example: string
description: String with at most 1024 characters.
reason_uri:
type: string
example: string
description: A URI
required:
- source
- observable
- priority
- confidence
- severity
example:
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
description: Schema for submitting new Judgements.
uniqueItems: true
example:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
description: a list of `NewJudgement`s.
malwares:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- malware
example: malware
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
labels:
type: array
items:
type: string
example: adware
description: Malware label is an open vocabulary that represents different types and functions of malware. Malware labels are not mutually exclusive; a malware instance can be both spyware and a screen capture tool.
example:
- adware
description: The type of malware being described.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: The list of Kill Chain Phases for which this Malware can be used.
x_mitre_aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Software.aliases.
abstraction_level:
type: string
enum:
- family
- variant
- version
example: family
description: Malware abstraction level.
required:
- title
- description
- short_description
- labels
example:
description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new Malware.
uniqueItems: true
example:
- description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewMalware`s.
notes:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- note
example: note
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
note_class:
type: string
example: keyword
content:
type: string
example: string
description: Markdown string with at most 5000 characters.
related_entities:
type: array
items:
type: object
properties:
entity_type:
type: string
example: string
entity_id:
type: string
example: string
description: A URI leading to an entity.
required:
- entity_type
- entity_id
example:
entity_type: string
entity_id: string
example:
- entity_type: string
entity_id: string
author:
type: string
example: string
required:
- note_class
- content
- related_entities
example:
schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
description: Schema for submitting Notes
uniqueItems: true
example:
- schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
description: a list of `NewNote`s.
relationships:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- relationship
example: relationship
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
relationship_type:
type: string
example: attributed-to
source_ref:
type: string
example: string
description: A URI leading to an entity.
target_ref:
type: string
example: string
description: A URI leading to an entity.
required:
- relationship_type
- source_ref
- target_ref
example:
description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
description: Schema for submitting new Relationships.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
description: a list of `NewRelationship`s.
sightings:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- sighting
example: sighting
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
count:
type: integer
format: int64
example: 10
description: 'The number of times an indicator was observed within a certain period of time.
For example, if an IP address associated with known malicious activity is observed once within a period of time, it may indicate a low-level threat. However, if the same IP address is observed multiple times within a short time frame, it may indicate a more severe and persistent threat.
It can also be used to prioritize security alerts and indicate the urgency of a response. High counts indicate that an indicator is actively being used in a larger campaign, while low counts may indicate isolated incidents.'
internal:
type: boolean
example: false
description: "If `true`, indicates that the sighting was reported from internal sources, such as an organization's own internal security tools or SOC.\n Internal sightings are often considered more reliable and actionable than external sightings, which are reported from external sources and may have a lower level of trustworthiness. Internal sightings can provide more context and can help identify potential threats that are unique to a particular environment or organization.\n Internal sightings can also help organizations prioritize their security response efforts by identifying threats that are specific to their environment and may not yet be widely known."
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
resolution:
type: string
example: detected
description: Represents the disposition or actions taken on the associated threat intelligence.
data:
type: object
properties:
columns:
type: array
items:
type: object
properties:
name:
type: string
example: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
example: integer
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
type: boolean
example: true
description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`.
short_description:
type: string
example: string
required:
- name
- type
example:
name: string
type: integer
description: string
required: true
short_description: string
example:
- name: string
type: integer
description: string
required: true
short_description: string
description: an ordered list of column definitions
rows:
type: array
items:
type: array
items:
example: anything
example:
- - anything
description: an ordered list of rows
row_count:
type: integer
format: int64
example: 10
description: The number of rows in the data table.
required:
- columns
- rows
example:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: An embedded data table for the Sighting.
sensor:
type: string
example: endpoint
description: The OpenC2 Actuator name that best fits the device that is creating this sighting (e.g. network.firewall)
sensor_coordinates:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
os:
type: string
example: string
required:
- type
- observables
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
description: Describes the device that made the sighting (sensor) and contains identifying observables for the sensor.
targets:
type: array
items:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
os:
type: string
example: string
required:
- type
- observables
- observed_time
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
description: Describes the target of the sighting and contains identifying observables for the target.
example:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
description: 'May include one or more targets that observed the associated indicator. Targets can include network devices, host devices, or other entities that are capable of detecting indicators of compromise.
Can be used to assess the scope of potential threats, helping analysts understand which devices or components of the network may be vulnerable to attack. For example, if a particular malware strain is detected on several different systems within an organization, the `targets` field may indicate which systems are affected and which may need to be isolated or patched to prevent further spread.'
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
description: The object(s) of interest.
relations:
type: array
items:
type: object
properties:
origin:
type: string
example: string
origin_uri:
type: string
example: string
description: A URI
relation:
type: string
example: Allocated
relation_info:
type: object
additionalProperties:
example: anything
example:
keyword: anything
properties: {}
source:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
related:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
required:
- origin
- relation
- source
- related
example:
origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
description: A relation inside a Sighting.
example:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
description: Provide any context we can about where the observable came from.
context:
type: object
properties:
process_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- ProcessCreateEvent
example: ProcessCreateEvent
process_args:
type: string
example: string
description: String with at most 2048 characters.
process_hash:
type: string
example: string
description: String with at most 2048 characters.
process_size:
type: integer
format: int64
example: 10
process_disposition:
type: string
example: string
description: String with at most 1024 characters.
parent_creation_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
parent_process_id:
type: integer
format: int64
example: 10
parent_process_guid:
type: integer
format: int64
example: 10
parent_process_name:
type: string
example: string
description: String with at most 1024 characters.
parent_process_args:
type: string
example: string
description: String with at most 2048 characters.
parent_process_username:
type: string
example: string
description: String with at most 1024 characters.
parent_process_hash:
type: string
example: string
description: String with at most 2048 characters.
parent_process_size:
type: integer
format: int64
example: 10
parent_process_disposition:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- type
example:
parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
example:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
description: a list of `ProcessCreate`
library_load_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- LibraryLoadEvent
example: LibraryLoadEvent
dll_library_name:
type: string
example: string
description: String with at most 1024 characters.
dll_library_path:
type: string
example: string
description: String with at most 2048 characters.
required:
- time
- process_id
- process_name
- type
- dll_library_name
- dll_library_path
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
description: a list of `LibraryLoadType`
file_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileCreateEvent
example: FileCreateEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileCreateType`
file_delete_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileDeleteEvent
example: FileDeleteEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileDeleteType`
file_modify_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileModifyEvent
example: FileModifyEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileModifyType`
file_move_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileMoveEvent
example: FileMoveEvent
old_name:
type: string
example: string
description: String with at most 1024 characters.
new_name:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
- old_name
- new_name
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
description: a list of `FileMoveType`
netflow_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- NetflowEvent
example: NetflowEvent
traffic:
type: object
properties:
protocol:
type: integer
format: int64
example: 10
description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
source_ip:
type: string
example: string
destination_ip:
type: string
example: string
source_port:
type: integer
format: int64
example: 10
destination_port:
type: integer
format: int64
example: 10
direction:
type: string
enum:
- incoming
- outgoing
example: incoming
destination_host_name:
type: string
example: string
source_subnet:
type: string
example: string
destination_subnet:
type: string
example: string
required:
- protocol
- source_ip
- destination_ip
- source_port
- destination_port
- direction
example:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
process_path:
type: string
example: string
description: String with at most 1024 characters.
process_args:
type: string
example: string
description: String with at most 1024 characters.
process_hash:
type: string
example: string
description: String with at most 1024 characters.
process_account_type:
type: string
example: string
description: String with at most 1024 characters.
process_account:
type: string
example: string
description: String with at most 1024 characters.
parent_process_id:
type: integer
format: int64
example: 10
parent_process_name:
type: string
example: string
description: String with at most 1024 characters.
parent_process_path:
type: string
example: string
description: String with at most 1024 characters.
parent_process_args:
type: string
example: string
description: String with at most 1024 characters.
parent_process_hash:
type: string
example: string
description: String with at most 1024 characters.
parent_process_account:
type: string
example: string
description: String with at most 1024 characters.
parent_process_account_type:
type: string
example: string
description: String with at most 1024 characters.
flow_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
byte_count_out:
type: integer
format: int64
example: 10
byte_count_in:
type: integer
format: int64
example: 10
required:
- time
- process_id
- process_name
- type
- traffic
example:
parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
example:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
description: a list of `NetflowType`
http_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- HTTPEvent
example: HTTPEvent
host:
type: string
example: string
description: String with at most 1024 characters.
traffic:
type: object
properties:
protocol:
type: integer
format: int64
example: 10
description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
source_ip:
type: string
example: string
destination_ip:
type: string
example: string
source_port:
type: integer
format: int64
example: 10
destination_port:
type: integer
format: int64
example: 10
direction:
type: string
enum:
- incoming
- outgoing
example: incoming
destination_host_name:
type: string
example: string
source_subnet:
type: string
example: string
destination_subnet:
type: string
example: string
required:
- protocol
- source_ip
- destination_ip
- source_port
- destination_port
- direction
example:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
url_port:
type: integer
format: int64
example: 10
query:
type: string
example: string
description: String with at most 5000 characters.
encrypted:
type: boolean
example: true
method:
type: string
enum:
- CONNECT
- GET
- HEAD
- OPTIONS
- PATCH
- POST
- PUT
- TRACE
example: CONNECT
required:
- time
- process_id
- process_name
- type
- host
- traffic
example:
process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
example:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
description: a list of `HTTPType`
registry_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryCreateEvent
example: RegistryCreateEvent
required:
- time
- process_id
- process_name
- registry_key
- type
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
description: a list of `RegistryCreateType`
registry_set_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistrySetEvent
example: RegistrySetEvent
registry_value:
type: string
example: string
description: String with at most 2048 characters.
registry_data_length:
type: integer
format: int64
example: 10
registry_data:
type: string
example: string
description: String with at most 5000 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
- registry_value
example:
process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
example:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
description: a list of `RegistrySetType`
registry_delete_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryDeleteEvent
example: RegistryDeleteEvent
registry_value:
type: string
example: string
description: String with at most 2048 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
description: a list of `RegistryDeleteType`
registry_rename_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryRenameEvent
example: RegistryRenameEvent
registry_old_key:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
- registry_old_key
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
description: a list of `RegistryRenameType`
example:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
description: Context including the event type that best fits the type of the sighting.
activity_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the malicious activity occurred. For example, the time when a malware sample was executing, or the time range of a network intrusion.
detection_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the malicious activity was detected by the source engine or security tool. This may differ from the activity_interval if detection occurred after the activity.
modification_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the sighting record was created or last updated in the system.
required:
- observed_time
example:
description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: For submitting a new Sighting.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: a list of `NewSighting`s.
identity_assertions:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- identity-assertion
example: identity-assertion
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
identity:
type: object
properties:
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
required:
- observables
example:
observables:
- value: 1.2.3.4
type: ip
description: Attributes for which the assertion is being made.
assertions:
type: array
items:
type: object
properties:
name:
type: string
example: cisco:ctr:ad:host_domain_name
description: An open vocabulary containing well known assertion types
value:
type: string
example: string
required:
- name
- value
example:
name: cisco:ctr:ad:host_domain_name
value: string
example:
- name: cisco:ctr:ad:host_domain_name
value: string
description: Any known context about the identity attributes.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- identity
- assertions
example:
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
description: For submitting a new IdentityAssertion.
uniqueItems: true
example:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
description: a list of `NewIdentityAssertion`s.
target_records:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- target-record
example: target-record
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
targets:
type: array
items:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
os:
type: string
example: string
description: Source Operating System where TargetRecord was originated.
internal:
type: boolean
example: false
description: Is it internal to our network?
sensor:
type: string
example: string
description: 'The OpenC2 Actuator name that best fits the device that is creating this TargetRecord (e.g.: network.firewall, etc.)'
source_uri:
type: string
example: string
description: A URI
required:
- type
- observables
- observed_time
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
description: Schema for TargetRecord Targets
example:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
required:
- source
- targets
example:
description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new TargetRecord.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewTargetRecord`s.
tools:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- tool
example: tool
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
labels:
type: array
items:
type: string
example: credential-exploitation
description: Tool labels describe the categories of tools that can be used to perform attacks.
example:
- credential-exploitation
description: The kind(s) of tool(s) being described.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: The list of kill chain phases for which this Tool can be used.
tool_version:
type: string
example: string
description: The version identifier associated with the Tool.
x_mitre_aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Software.aliases.
required:
- title
- description
- short_description
- labels
example:
description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new Tool.
uniqueItems: true
example:
- description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewTool`s.
verdicts:
type: array
items:
type: object
properties:
type:
type: string
enum:
- verdict
example: verdict
disposition:
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Numeric verdict identifiers.
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
disposition_name:
type: string
enum:
- Clean
- Common
- Malicious
- Suspicious
- Unknown
example: Clean
description: 'The disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}'
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- type
- disposition
- observable
- valid_time
example:
type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: "A Verdict is chosen from all of the Judgements on that Observable which have not yet expired. The highest priority Judgement becomes the active verdict. If there is more than one Judgement with that priority, then Clean disposition has priority over all others, then Malicious disposition, and so on down to Unknown.\n\n The ID of a verdict is a a str of the form \"observable.type:observable.value\" for example, \"ip:1.1.1.1\""
uniqueItems: true
example:
- type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: a list of `Verdict`s.
data_tables:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- data-table
example: data-table
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
columns:
type: array
items:
type: object
properties:
name:
type: string
example: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
example: integer
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
type: boolean
example: true
description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`.
short_description:
type: string
example: string
required:
- name
- type
example:
name: string
type: integer
description: string
required: true
short_description: string
example:
- name: string
type: integer
description: string
required: true
short_description: string
description: An ordered list of column definitions.
rows:
type: array
items:
type: array
items:
example: anything
example:
- - anything
description: An ordered list of rows
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
row_count:
type: integer
format: int64
example: 10
description: The number of rows in the data table.
required:
- columns
- rows
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting a NewDataTable record.
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewDataTable`s.
weaknesses:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- weakness
example: weakness
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: Should be short and limited to the key points that define this weakness.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
structure:
type: string
enum:
- Chain
- Composite
- Simple
example: Chain
description: Defines the structural nature of the weakness.
languages:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Language name (Clojure, Java, ...)
class:
type: string
example: Assembly
description: Class of language.
required:
- prevalence
example:
prevalence: Often
name: string
class: Assembly
example:
- prevalence: Often
name: string
class: Assembly
description: Applicable Languages.
operating_systems:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: String with at most 1024 characters.
version:
type: string
example: string
description: String with at most 1024 characters.
cpe_id:
type: string
example: string
description: String with at most 1024 characters.
class:
type: string
example: Android
description: Class of Operating System.
required:
- prevalence
example:
prevalence: Often
name: string
version: string
cpe_id: string
class: Android
example:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
description: Applicable operating systems.
architectures:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Architecture name (ARM, x86, ...)
class:
type: string
example: Embedded
description: Class of architecture
required:
- prevalence
example:
prevalence: Often
name: string
class: Embedded
example:
- prevalence: Often
name: string
class: Embedded
description: Applicable architectures.
paradigms:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Paradigm name (Client Server, Mainframe)
required:
- prevalence
example:
prevalence: Often
name: string
example:
- prevalence: Often
name: string
description: Applicable paradigms.
technologies:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Technology name (Web Server, Web Client)
required:
- prevalence
example:
prevalence: Often
name: string
example:
- prevalence: Often
name: string
description: Applicable technologies.
background_details:
type: string
example: string
description: Information that is relevant but not related to the nature of the weakness itself.
alternate_terms:
type: array
items:
type: object
properties:
term:
type: string
example: string
description: The actual alternate term.
description:
type: string
example: string
description: Provides context for the alternate term by which this weakness may be known.
required:
- term
example:
term: string
description: string
example:
- term: string
description: string
description: Indicates one or more other names used to describe this weakness.
modes_of_introduction:
type: array
items:
type: object
properties:
phase:
type: string
example: Architecture and Design
description: Identifies the point in the software life cycle at which the weakness may be introduced.
note:
type: string
example: string
description: Provides a typical scenario related to introduction during the given phase.
required:
- phase
example:
phase: Architecture and Design
note: string
example:
- phase: Architecture and Design
note: string
description: Information about how and when a given weakness may be introduced.
likelihood:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Likelihood of exploit.
common_consequences:
type: array
items:
type: object
properties:
scopes:
type: array
items:
type: string
example: Access Control
description: Defines the different areas of software security that can be affected by exploiting a weakness.
example:
- Access Control
description: Identifies the security property that is violated.
impacts:
type: array
items:
type: string
example: Alter Execution Logic
example:
- Alter Execution Logic
description: Describes the technical impact that arises if an adversary succeeds in exploiting this weakness.
likelihood:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: How likely the specific consequence is expected to be seen relative to the other consequences.
note:
type: string
example: string
description: Additional commentary about a consequence.
required:
- scopes
example:
scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
example:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
description: Refers to the typical or expected negative effects that can result from exploiting the weakness. This could include anything from unauthorized access to data, denial of service, system crashes or other things.
detection_methods:
type: array
items:
type: object
properties:
method:
type: string
example: Architecture or Design Review
description: Identifies the particular detection method being described.
description:
type: string
example: string
description: Provides some context of how this method can be applied to a specific weakness.
effectiveness:
type: string
example: High
description: How effective the detection method may be in detecting the associated weakness.
effectiveness_notes:
type: string
example: string
description: Provides additional discussion of the strengths and shortcomings of this detection method.
required:
- method
- description
example:
method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
example:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
description: Identifies methods that may be employed to detect this weakness, including their strengths and limitations.
potential_mitigations:
type: array
items:
type: object
properties:
description:
type: string
example: string
description: A description of this individual mitigation including any strengths and shortcomings of this mitigation for the weakness.
phases:
type: array
items:
type: string
example: Architecture and Design
description: Defines the different regularities that guide the applicability of platforms.
example:
- Architecture and Design
description: Indicates the development life cycle phase during which this particular mitigation may be applied.
strategy:
type: string
example: Attack Surface Reduction
description: A general strategy for protecting a system to which this mitigation contributes.
effectiveness:
type: string
example: Defense in Depth
description: Summarizes how effective the mitigation may be in preventing the weakness.
effectiveness_notes:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
- description
example:
description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
example:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
description: Describes potential mitigations associated with a weakness.
functional_areas:
type: array
items:
type: string
example: Authentication
description: Defines the different functional areas of software in which the weakness may appear.
example:
- Authentication
description: Identifies the functional area of the software in which the weakness is most likely to occur.
affected_resources:
type: array
items:
type: string
example: CPU
description: Defines a resource of a system.
example:
- CPU
description: Identifies system resources that can be affected by an exploit of this weakness.
notes:
type: array
items:
type: object
properties:
type:
type: string
example: Applicable Platform
description: Defines the different types of notes that can be associated with a weakness.
note:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
- type
- note
example:
type: Applicable Platform
note: string
example:
- type: Applicable Platform
note: string
description: Provides any additional comments about the weakness.
abstraction_level:
type: string
enum:
- Base
- Class
- Compound
- Variant
example: Base
description: Refers to the level of abstraction or granularity used to describe the weakness. It helps to categorize the vulnerability based on the level of detail provided.
required:
- description
example:
description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
description: For submitting a new weakness.
uniqueItems: true
example:
- description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
description: a list of `NewWeakness`s.
vulnerabilities:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- vulnerability
example: vulnerability
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: "Various sources of vulnerability information can be used, including third-party resources like the National Vulnerability Database (NVD) and the Common Vulnerabilities and Exposures (CVE) database. The platform then analyzes this data and provides the user with relevant details such as the severity of the vulnerability, the affected systems, and remediation recommendations. \n\n Based on this information, the user can prioritize patching and other mitigation strategies to reduce the risk of potential attacks."
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
cve:
type: object
properties:
cve_data_meta:
type: object
properties:
id:
type: string
example: string
description: String with at most 1024 characters.
assigner:
type: string
example: string
description: String with at most 1024 characters.
example:
id: string
assigner: string
required:
- cve_data_meta
example:
cve_data_meta:
id: string
assigner: string
impact:
type: object
properties:
cvss_v2:
type: object
properties:
vector_string:
type: string
example: string
description: a text representation of a set of CVSSv2 metrics. It is commonly used to record or transfer CVSSv2 metric information in a concise form
base_score:
type: number
format: double
example: 10.0
description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v2/guide'
base_severity:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
impact_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
exploitability_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
access_vector:
type: string
enum:
- adjacent network
- local
- network
example: network
description: This metric reflects how the vulnerability is exploited.The more remote an attacker can be to attack a host, the greater the vulnerability score.
access_complexity:
type: string
enum:
- high
- low
- medium
example: low
description: 'This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system. For example, consider a buffer overflow in an Internet service: once the target system is located, the attacker can launch an exploit at will.'
authentication:
type: string
enum:
- multiple
- none
- single
example: none
description: This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. This metric does not gauge the strength or complexity of the authentication process, only that an attacker is required to provide credentials before an exploit may occur. The fewer authentication instances that are required, the higher the vulnerability score.
confidentiality_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact on confidentiality of a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. Increasedconfidentiality impact increases the vulnerability score.
integrity_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information. Increased integrity impact increases the vulnerability score.
availability_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact to availability of a successfully exploited vulnerability. Availability refers to the accessibility of information resources. Attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system. Increased availability impact increases the vulnerability score.
exploitability:
type: string
enum:
- functional
- high
- not_defined
- proof_of_concept
- unproven
example: not_defined
description: This metric measures the current state of exploit techniques or code availability. Public availability of easy-to-use exploit code increases the number of potential attackers by including those who are unskilled thereby increasing the severity of the vulnerability.
remediation_level:
type: string
enum:
- not_defined
- official_fix
- temporary_fix
- unavailable
- workaround
example: not_defined
description: The remediation level of a vulnerability is an important factor for prioritization. The typical vulnerability is unpatched when initially published. Workarounds or hotfixes may offer interim remediation until an official patch or upgrade is issued. Each of these respective stages adjusts the temporal score downwards, reflecting the decreasing urgency as remediation becomes final. The less official and permanent a fix, the higher the vulnerability score is.
report_confidence:
type: string
enum:
- confirmed
- not_defined
- unconfirmed
- uncorroborated
example: not_defined
description: This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details. Sometimes, only the existence of vulnerabilities are publicized, but without specific details. The vulnerability may later be corroborated and then confirmed through acknowledgement by the author or vendor of the affected technology. The urgency of a vulnerability is higher when a vulnerability is known to exist with certainty. This metric also suggests the level of technical knowledge available to would-be attackers. The more a vulnerability is validated by the vendor or other reputable sources, the higher the score.
temporal_vector_string:
type: string
example: string
description: A text representation of a set of CVSSv2 temporal metrics. Temporal metrics allow analysists to calculate threat severity based on temporal factors such as reliability of vulnerability reports, availability of mitigations, and the ease or difficulty of conducting the exploit. It is commonly used to record or transfer CVSSv2 metric information in a concise form
collateral_damage_potential:
type: string
enum:
- high
- low
- low_medium
- medium_high
- none
- not_defined
example: not_defined
description: This metric measures the potential for loss of life or physical assets through damage or theft of property or equipment. The metric may also measure economic loss of productivity or revenue. Naturally, the greater the damage potential, the higher the vulnerability score.
target_distribution:
type: string
enum:
- high
- low
- medium
- none
- not_defined
example: not_defined
description: This metric measures the proportion of vulnerable systems. It is meant as an environment-specific indicator in order to approximate the percentage of systems that could be affected by the vulnerability. The greater the proportion of vulnerable systems, the higher the score.
confidentiality_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
integrity_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
availability_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
environmental_vector_string:
type: string
example: string
description: A text representation of a set of CVSSv2 environmental metrics. Environmental metrics allow analysists to calculate threat scores in relation to environmental security requirements, collateral damage potential, and target availability. It is commonly used to record or transfer CVSSv2 metric information in a concise form
obtain_all_privilege:
type: boolean
example: true
obtain_user_privilege:
type: boolean
example: true
obtain_other_privilege:
type: boolean
example: true
user_interaction_required:
type: boolean
example: true
required:
- vector_string
- base_score
- base_severity
example:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
type: object
properties:
vector_string:
type: string
example: string
description: a text representation of a set of CVSSv3 metrics. It is commonly used to record or transfer CVSSv3 metric information in a concise form
base_score:
type: number
format: double
example: 10.0
description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v3-1'
base_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
impact_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
exploitability_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
attack_vector:
type: string
enum:
- adjacent_network
- local
- network
- physical
example: adjacent_network
description: Reflects the context by which vulnerability exploitation is possible
modified_attack_vector:
type: string
enum:
- adjacent_network
- local
- network
- not_defined
- physical
example: not_defined
description: modified attack vector
attack_complexity:
type: string
enum:
- high
- low
example: high
description: describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability
modified_attack_complexity:
type: string
enum:
- high
- low
- not_defined
example: not_defined
description: modified attack complexity
privileges_required:
type: string
enum:
- high
- low
- none
example: high
description: describes the level of privileges an attacker must possess before successfully exploiting the vulnerability
modified_privileges_required:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified privileges required
user_interaction:
type: string
enum:
- none
- required
example: none
description: captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component
modified_user_interaction:
type: string
enum:
- none
- not_defined
- required
example: none
description: modified user interaction
scope:
type: string
enum:
- changed
- unchanged
example: changed
description: the ability for a vulnerability in one software component to impact resources beyond its means, or privileges
modified_scope:
type: string
enum:
- changed
- not_defined
- unchanged
example: not_defined
description: modified scope
confidentiality_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability
modified_confidentiality_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified confidentiality impact
integrity_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to integrity of a successfully exploited vulnerability
modified_integrity_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified integrity impact
availability_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability
modified_availability_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified availability impact
exploit_code_maturity:
type: string
enum:
- functional
- high
- not_defined
- proof_of_concept
- unproven
example: functional
description: measures the likelihood of the vulnerability being attacked
remediation_level:
type: string
enum:
- high
- not_defined
- offical_fix
- temporary_fix
- unavailable
- workaround
example: high
description: Remediation Level of a vulnerability is an important factor for prioritization
report_confidence:
type: string
enum:
- confirmed
- reasonable
- unknown
example: confirmed
description: measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details
temporal_score:
type: number
format: double
example: 10.0
description: Round up(CVSSv3BaseScore × CVSSv3ExploitCodeMaturity × CVSSv3RemediationLevel × CVSSv3ReportConfidence)
temporal_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
description: temporal severity
availability_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
confidentiality_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
integrity_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
environmental_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
environmental_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
required:
- vector_string
- base_score
- base_severity
example:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
example:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: "Describes the potential impact of a vulnerability that is being tracked in the system. Provides information on the extent of damage that a vulnerability can cause and how serious the consequences could be if it is exploited. \n\nMay contain granular information about the vulnerability severity using the CVSS system, versions 2 and 3.\n\nCVSSv2 and CVSSv3 have different methods of calculating base scores, but both are designed to provide an indication of the level of risk that a vulnerability poses. The base score ranges from 0 to 10, with 10 being the most severe. Additionally, both CVSSv2 and CVSSv3 define severity levels, such as low, medium, high, and critical, based on the base score."
configurations:
type: object
properties:
CVE_data_version:
type: string
example: string
description: Specifies the version of the CVE (Common Vulnerabilities and Exposures) dictionary used by the vulnerability information provider.
nodes:
type: array
items:
type: object
properties:
operator:
type: string
enum:
- AND
- OR
example: AND
description: The operator string influences how seqs of cpe matches are related to one another.
cpe_match:
type: array
items:
type: object
properties:
vulnerable:
type: boolean
example: true
cpe23Uri:
type: string
example: string
description: A text representation of a software or hardware platform.
versionStartIncluding:
type: string
example: string
description: A string representing the lower bound(inclusive) of version in the CPE.
versionEndIncluding:
type: string
example: string
description: A string representing the upper bound(inclusive) of version in the CPE.
versionStartExcluding:
type: string
example: string
description: A string representing the lower bound(exclusive) of version in the CPE.
versionEndExcluding:
type: string
example: string
description: A string representing the upper bound(exclusive) of version in the CPE.
required:
- vulnerable
- cpe23Uri
example:
vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
example:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
type: array
items:
type: object
properties:
operator:
type: string
enum:
- AND
- OR
example: AND
description: The operator string influences how seqs of cpe matches are related to one another.
cpe_match:
type: array
items:
type: object
properties:
vulnerable:
type: boolean
example: true
cpe23Uri:
type: string
example: string
description: A text representation of a software or hardware platform.
versionStartIncluding:
type: string
example: string
description: A string representing the lower bound(inclusive) of version in the CPE.
versionEndIncluding:
type: string
example: string
description: A string representing the upper bound(inclusive) of version in the CPE.
versionStartExcluding:
type: string
example: string
description: A string representing the lower bound(exclusive) of version in the CPE.
versionEndExcluding:
type: string
example: string
description: A string representing the upper bound(exclusive) of version in the CPE.
required:
- vulnerable
- cpe23Uri
example:
vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
example:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate:
type: boolean
example: true
description: Negates operator when true.
required:
- operator
- cpe_match
example:
operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
example:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate:
type: boolean
example: true
description: Negates operator when true.
required:
- operator
example:
operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
example:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
description: Each `node` in the CTIM standard configuration includes information such as the `operator` (such as "less than", or "greater than or equal to"), and the `cpe` (Common Platform Enumeration) string which identifies the specific software, `CPE` is a structured naming scheme for IT systems, platforms, and software packages, and it is instrumental in enabling data exchange between different systems.
required:
- CVE_data_version
- nodes
example:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
description: "Represents a list of affected versions or configurations of a software component that is impacted by a vulnerability. \nBy tracking the affected software components and versions, defenders can identify which systems are potentially exposed to an attack, and apply appropriate mitigations."
published_date:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: "Represents the date when a vulnerability was publicly disclosed or made available to the general public. \n\nImportant for tracking the age of a vulnerability, as well as for determining when a particular vulnerability was first introduced into a system. The published date can be used to identify the time window during which a system may have been vulnerable to a particular exploit.\n\nFor example, if an organization discovers that a vulnerability was published before their system's installation date, but they did not apply the necessary security updates in a timely manner, it can be concluded that their system was vulnerable for the period between the installation date and the date when the necessary security updates were applied."
last_modified_date:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: 'Represents the date when the vulnerability metadata was last updated in the internal database.
It can be used to track the freshness of the vulnerability information. If the `last_modified_date` is more recent than the `published_date`, it can indicate that there has been some new information or updates related to the vulnerability, such as new patch releases or changes in the severity or impact rating.'
required:
- description
example:
description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: For submitting a new vulnerability.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: a list of `NewVulnerability`s.
actor_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_mapping_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_properties_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
attack_pattern_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
campaign_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
coa_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
feedback_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
identity_assertion_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
incident_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
indicator_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
judgement_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
malware_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
note_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
relationship_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
sighting_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
target_record_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
tool_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
verdict_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
data_table_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
weakness_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
vulnerability_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- source
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
asset_mapping_refs:
- string
note_refs:
- string
data_table_refs:
- string
attack_pattern_refs:
- string
sighting_refs:
- string
schema_version: 1.3.30
revision: 10
assets:
- description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
weakness_refs:
- string
tool_refs:
- string
target_record_refs:
- string
asset_refs:
- string
tools:
- description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
indicators:
- description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
attack_patterns:
- description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
type: bundle
weaknesses:
- description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
source: string
external_ids:
- string
feedback_refs:
- string
asset_properties:
- properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
short_description: string
feedbacks:
- feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
judgement_refs:
- string
title: string
coa_refs:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
verdicts:
- type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
campaigns:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
source_uri: string
actors:
- description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
indicator_refs:
- string
actor_refs:
- string
language: string
data_tables:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
id: string
notes:
- schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
identity_assertions:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
judgements:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
malwares:
- description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
target_records:
- description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
asset_mappings:
- asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
relationship_refs:
- string
tlp: green
incidents:
- description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
identity_assertion_refs:
- string
sightings:
- description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
campaign_refs:
- string
vulnerability_refs:
- string
asset_properties_refs:
- string
relationships:
- description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
timestamp: '2016-01-01T01:01:01Z'
verdict_refs:
- string
malware_refs:
- string
incident_refs:
- string
vulnerabilities:
- description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
coas:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: Describes a Bundle of any set of CTIM entities.
investigated_observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
required:
- bundle
application/edn:
schema:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- bundle
example: bundle
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
actors:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- actor
example: actor
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Indicates the time span for which the information about the Actor is relevant, and after which it could become outdated.
actor_types:
type: array
items:
type: string
example: Cyber Espionage Operations
example:
- Cyber Espionage Operations
identity:
type: object
properties:
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
related_identities:
type: array
items:
type: object
properties:
identity:
type: string
example: string
description: The reference (URI) of the related Identity object.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Specifies the level of confidence in the assertion of the relationship between the two objects.
information_source:
type: string
example: string
description: Specifies the source of the information about the relationship between the two components.
relationship:
type: string
example: string
required:
- identity
example:
identity: string
confidence: High
information_source: string
relationship: string
description: Describes a related Identity
example:
- identity: string
confidence: High
information_source: string
relationship: string
description: Identifies other entity Identities related to this Identity.
required:
- description
- related_identities
example:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
description: Can contain information such as the name of the attacker, the group or organization they belong to, or any other identifier that can help in the attribution process.
motivation:
type: string
example: Ego
description: The reason or purpose behind the malicious activity attributed to this Actor. By understanding a threat actor's motivation, analysts can better predict the attacker's behavior and anticipate future malicious actions.
sophistication:
type: string
enum:
- Aspirant
- Expert
- Innovator
- Novice
- Practitioner
example: Aspirant
description: "Represents the level of expertise and skill that the threat actor has displayed in their malicious activities. Can help security analysts assess the potential impact of an attacker's TTPs and determine the potential attack surface. \n\nFor example, a threat actor with a low sophistication level may primarily rely on off-the-shelf malware and attack tools, while an attacker with high sophistication may use custom tools with advanced evasion techniques, zero-day exploits, and sophisticated methods for command and control of their malware. \n\nThe sophistication level of an attacker can also be inferred based on several factors such as the complexity of attacks, the attacker's knowledge of the targeted organization's systems, and the attacker's ability to remain undetected.\n\nIf an attacker shows a high level of sophistication in reconnaissances, social engineering, and phishing, then the attacker may have a good knowledge of the targeted organization and its employees. This means that the attacker may be more successful in infiltrating the organization's network and compromising its systems."
intended_effect:
type: string
example: Account Takeover
description: "Represents the desired outcome or impact the threat actor is trying to achieve through their malicious activities. \n\n Helps security analysts to understand the attacker's goals beyond the immediate impact of the attack. By understanding the intended effect, analysts can draw connections between seemingly unrelated attacks and build a more complete understanding of an attacker's long-term goals and motivations."
planning_and_operational_support:
type: string
example: string
description: "Provides information about the resources and capabilities of the attacker that could be used to assist in planning and operations related to the threat.\n\n It can be used to describe Infrastructure, Tools, Techniques, and Capabilities used by the threat actor."
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'This field can help analysts decide how much trust they can put in the information provided by the threat intelligence sources.
For example, an Actor entity can have high confidence if the organization''s security researchers have been tracking it for a long time and have gathered a significant amount of intelligence about it through various sources, such as analysis of malware, network traffic, and human intelligence. In contrast, low confidence may indicate the organization has only seen limited or circumstantial evidence.'
aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: A list of other names that this Threat Actor is believed to use.
required:
- source
- title
- description
- short_description
example:
description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
description: Schema for submitting new Actors
uniqueItems: true
example:
- description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
description: a list of `NewActor`s.
assets:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset
example: asset
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: 'Specifies the time range during which the asset is considered valid or accurate.
For example, if an asset entity represents a device, the `valid_time` field could be used to indicate the period during which the device''s configuration information is deemed accurate.'
asset_type:
type: string
enum:
- application
- data
- device
- network
- person
example: application
description: 'Type of the Asset: Device, Person, Application, etc.'
required:
- source
- valid_time
- asset_type
example:
description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new Assets
uniqueItems: true
example:
- description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAsset`s.
asset_mappings:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset-mapping
example: asset-mapping
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: For each asset, we allow for the assertion of time bound properties.This gives us both a record of the current state of the asset,as well as history.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'Level of confidence held in the characterization of this AssetMapping e.g.: is it susceptible to manipulation or translation?'
specificity:
type: string
enum:
- Low
- Medium
- Unique
example: Low
description: Denotes the level of how many assets potentially could have this same identifier.
stability:
type: string
enum:
- Managed
- Physical
- Temporary
example: Managed
description: Do we manage when it changes, or is it always a time bound assignment?
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: An AssetMapping is a record that a specific Observable maps to an Asset for an indicated period of time.
asset_ref:
type: string
example: string
description: URI that points to the mapped Asset.
asset_type:
type: string
enum:
- application
- data
- device
- network
- person
example: application
description: 'Type of the mapped Asset: Device, Person, Application, etc.'
required:
- source
- valid_time
- confidence
- specificity
- stability
- observable
- asset_ref
- asset_type
example:
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
description: Schema for submitting new AssetMapping.
uniqueItems: true
example:
- asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
description: a list of `NewAssetMapping`s.
asset_properties:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- asset-properties
example: asset-properties
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which the AssetProperties is considered valid.
asset_ref:
type: string
example: string
description: URI that points to the associated Asset.
properties:
type: array
items:
type: object
properties:
name:
type: string
example: string
description: The properties are an open vocabulary.
value:
type: string
example: string
required:
- name
- value
example:
name: string
value: string
example:
- name: string
value: string
required:
- source
- valid_time
- asset_ref
example:
properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new AssetProperties
uniqueItems: true
example:
- properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAssetProperties`s.
attack_patterns:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- attack-pattern
example: attack-pattern
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: A kill chain is a series of steps that an attacker must go through to successfully achieve their objective. The concept was originally developed by the military, but has been adapted to the cybersecurity field to describe the steps an attacker goes through to compromise a target system and achieve their goal.
x_mitre_data_sources:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Data Sources.
x_mitre_platforms:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Platforms.
x_mitre_contributors:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Technique.Contributors.
abstraction_level:
type: string
enum:
- aggregate
- category
- detailed
- meta
- standard
example: aggregate
description: The CAPEC abstraction level for patterns describing techniques to attack a system.
required:
- title
- description
- short_description
example:
description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new AttackPattern
uniqueItems: true
example:
- description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewAttackPattern`s.
campaigns:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- campaign
example: campaign
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Timestamp for the definition of a specific version of a campaign.
campaign_type:
type: string
example: string
description: 'String value that describes the type of campaign. For example, a campaign type could be ''Ransomware'', ''Advanced Persistent Threat'', ''Business Email Compromise'', ''Phishing'', etc. '
names:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Used to capture alternate names or aliases associated with the campaign. A cyberattack campaign may have multiple names or aliases depending on the group or actor(s) behind the attack, e.g., 'Wannacry' is also known as 'WannaCrypt', 'WCry', 'Wanna Decryptor', etc.
intended_effect:
type: array
items:
type: string
example: Account Takeover
example:
- Account Takeover
description: Characterizes the intended effect of this cyber threat campaign.
status:
type: string
enum:
- Future
- Historic
- Ongoing
example: Future
description: "Indicates current Status of the Campaign. \n\nCan have one of the following values: \n\n- Ongoing: Indicates that the campaign is currently active and ongoing. For example, a mass phishing campaign that is actively targeting users is considered 'ongoing'.\n\n- Historic: Campaign has already occurred and is now in the past.\n\n- Future: This indicates that a campaign is planned or expected to occur in the future. For example, a threat actor may announce their intention to launch a specific cyberattack campaign at a future date."
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Level of confidence held in the characterization of this Campaign.
activity:
type: array
items:
type: object
properties:
date_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Specifies the date and time at which the activity occured.
description:
type: string
example: string
description: A description of the activity.
required:
- date_time
- description
example:
date_time: '2016-01-01T01:01:01Z'
description: string
description: Captures the specific activities or tactics associated with the entity. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc.
example:
- date_time: '2016-01-01T01:01:01Z'
description: string
description: 'Used to capture specific activities or tactics associated with the campaign.
The ''activity'' field is an array of objects, and each element represents a specific activity and time associated with the campaign. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc. By capturing these activities analysts can identify the specific tactics used by the threat actor(s) behind the campaign.'
required:
- title
- description
- short_description
- campaign_type
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
description: Schema for submitting new Campaigns
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
description: a list of `NewCampaign`s.
coas:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- coa
example: coa
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
stage:
type: string
enum:
- Containment
- Eradication
- Identification
- Lessons Learned
- Preparation
- Recovery
- Remedy
- Response
example: Containment
description: Specifies what stage in the cyber threat management lifecycle this Course Of Action is relevant to.
coa_type:
type: string
enum:
- Diplomatic Actions
- Eradication
- Hardening
- Internal Blocking
- Logical Access Restrictions
- Monitoring
- Other
- Patching
- Perimeter Blocking
- Phase
- Physical Access Restrictions
- Playbook
- Policy Actions
- Public Disclosure
- Rebuilding
- Redirection
- Redirection (Honey Pot)
- Task
- Training
example: Diplomatic Actions
description: The type of this COA
objective:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Characterizes the objective to provide guidance on how to mitigate a security incident that has been identified.
impact:
type: string
example: string
description: Characterizes the estimated impact of applying this course of action.
cost:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Characterizes the estimated cost for applying this course of action.
efficacy:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Effectiveness of this course of action in achieving its targeted objective.
related_COAs:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
COA_id:
type: string
example: string
description: A URI leading to a COA.
required:
- COA_id
example:
confidence: High
source: string
relationship: string
COA_id: string
example:
- confidence: High
source: string
relationship: string
COA_id: string
description: Identifies or characterizes relationships to one or more related courses of action.
structured_coa_type:
type: string
enum:
- openc2
example: openc2
open_c2_coa:
type: object
properties:
type:
type: string
enum:
- structured_coa
example: structured_coa
id:
type: string
example: string
description: String with at most 1024 characters.
action:
type: object
properties:
type:
type: string
enum:
- alert
- allow
- augment
- contain
- delete
- deny
- detonate
- distill
- get
- investigate
- locate
- mitigate
- modify
- move
- notify
- other
- pause
- query
- redirect
- remediate
- report
- response
- restart
- restore
- resume
- save
- scan
- set
- snapshot
- start
- stop
- substitute
- sync
- throttle
- update
example: alert
required:
- type
example:
type: alert
target:
type: object
properties:
type:
type: string
example: acudid
specifiers:
type: string
example: string
description: Observable types that can be acted upon.
required:
- type
example:
type: acudid
specifiers: string
actuator:
type: object
properties:
type:
type: string
enum:
- endpoint
- endpoint.digital-telephone-handset
- endpoint.laptop
- endpoint.pos-terminal
- endpoint.printer
- endpoint.sensor
- endpoint.server
- endpoint.smart-meter
- endpoint.smart-phone
- endpoint.tablet
- endpoint.workstation
- network
- network.bridge
- network.firewall
- network.gateway
- network.guard
- network.hips
- network.hub
- network.ids
- network.ips
- network.modem
- network.nic
- network.proxy
- network.router
- network.security_manager
- network.sense_making
- network.sensor
- network.switch
- network.vpn
- network.wap
- other
- process
- process.aaa-server
- process.anti-virus-scanner
- process.connection-scanner
- process.directory-service
- process.dns-server
- process.email-service
- process.file-scanner
- process.location-service
- process.network-scanner
- process.remediation-service
- process.reputation-service
- process.sandbox
- process.virtualization-service
- process.vulnerability-scanner
example: endpoint
specifiers:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: List of additional properties describing the actuator.
required:
- type
example:
type: endpoint
specifiers:
- string
modifiers:
type: object
properties:
delay:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
duration:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
frequency:
type: string
example: string
description: String with at most 1024 characters.
id:
type: string
example: string
description: String with at most 1024 characters.
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
response:
type: string
enum:
- acknowledge
- command-ref
- query
- status
example: acknowledge
source:
type: string
example: string
description: String with at most 1024 characters.
destination:
type: string
enum:
- copy-to
- modify-to
- move-to
- report-to
- restore-point
- save-to
- set-to
example: copy-to
method:
type: array
items:
type: string
enum:
- acl
- authenticated
- blackhole
- blacklist
- graceful
- hibernate
- honeypot
- immediate
- segmentation
- spawn
- suspend
- unauthenticated
- whitelist
example: acl
example:
- acl
search:
type: string
enum:
- cve
- patch
- signature
- vendor_bulletin
example: cve
location:
type: string
enum:
- internal
- perimeter
example: internal
option:
type: string
example: string
description: String with at most 1024 characters.
additional_properties:
type: object
properties:
context:
type: string
example: string
description: String with at most 1024 characters.
required:
- context
example:
context: string
example:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
required:
- type
- action
example:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: Schema for submitting new COAs
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: a list of `NewCOA`s.
feedbacks:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- feedback
example: feedback
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
entity_id:
type: string
example: string
description: A URI leading to an entity.
feedback:
type: integer
enum:
- -1
- 0
- 1
example: -1
reason:
type: string
example: string
required:
- entity_id
- feedback
- reason
example:
feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new Feedback.
uniqueItems: true
example:
- feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewFeedback`s.
incidents:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- incident
example: incident
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: 'Represents the level of certainty or trustworthiness associated with the incident. It denotes the reliability of the intelligence associated with the incident.
The `confidence` field can take on several values, including:
- `info`: Indicates that the incident information is based on sources with no previous track record or there is no track record for the source reporting the incident.
- `low`: Indicates that the incident information is based on sources with a questionable track record or there is limited information about the accuracy of the source.
- `medium`: Indicates that the incident information is based on sources with a mixed track record or of uncertain reliability.
- `high`: Indicates that the incident information is based on sources with a proven track record and high degree of reliability.
The `confidence` field can be used to indicate the level of trust and confidence that can be attributed to the incident, and it may impact how the incident is prioritized, analyzed and addressed. It can also help in the decision-making process associated with the incident response activities.
It is important to note that the `confidence` field is subjective and can be interpreted differently by different organizations or analysts. As such, it is often used in conjunction with other intelligence attributes, such as the `severity` field, to provide a more complete picture of the incident.'
status:
type: string
enum:
- Closed
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Closed: Merged'
- 'Closed: Near-Miss'
- 'Closed: Other'
- 'Closed: Suspected'
- 'Closed: Under Review'
- Containment Achieved
- Hold
- 'Hold: External'
- 'Hold: Internal'
- 'Hold: Legal'
- Incident Reported
- New
- 'New: Presented'
- 'New: Processing'
- Open
- 'Open: Contained'
- 'Open: Investigating'
- 'Open: Recovered'
- 'Open: Reported'
- Rejected
- Restoration Achieved
- Stalled
example: Closed
description: The `status` field represents the current state of an incident within the incident management process. Its values help in tracking and reporting the progress of the incident from its discovery to its resolution.
incident_time:
type: object
properties:
opened:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first opened.
discovered:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first discovered.
reported:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time the incident was first reported.
remediated:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the remediation of the damage from the incident was completed.
closed:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was last closed.
rejected:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was first rejected.
contained:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time that the incident was first contained.
required:
- opened
example:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
description: Relevant time values associated with this Incident.
meta:
type: object
additionalProperties:
type: string
example: string
x-anyOf:
- type: string
example: string
- type: number
format: double
example: 10.0
- type: string
format: date-time
example: '2016-01-01T01:01:01Z'
- type: string
example: keyword
- type: boolean
example: true
example:
keyword: string
description: metadata associated to the incident.
properties: {}
scores:
type: object
additionalProperties:
type: number
format: double
example: 10.0
description: A non-negative score number.
example:
asset: 10.0
description: Used to indicate the severity or impact score of the threat represented by the incident.
properties: {}
categories:
type: array
items:
type: string
example: Attrition
example:
- Attrition
description: A set of categories for this incident.
discovery_method:
type: string
example: Agent Disclosure
description: Identifies how the incident was discovered.
intended_effect:
type: string
example: Account Takeover
description: Specifies the suspected intended effect of this incident
assignees:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: A set of owners assigned to this incident.
detection_sources:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: A set of sources that contributed threat detections to the incident.
promotion_method:
type: string
enum:
- Automated
- Manual
example: Automated
description: Describes method for promoting an Incident, whether manually or automatically. An Incident may be created manually by a SOAR analyst or SOC operator, or through an automated correlation or aggregation rule or engine that matches a specific set of events or alerts, and promotes them to Incident(s).
detection_status:
type: string
enum:
- active
- inactive_expired
- inactive_merged
- inactive_oversized
- inactive_user_closed
example: active
description: Represents the state of an incident within the incident generation process, indicating whether the incident is actively receiving updates or is no longer being updated.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
description: "Represents the potential impact of an incident on an organization's security posture and business operations. It helps organizations prioritize and allocate resources for incident response based on the severity level of the incident \nIt helps analysts and incident handlers prioritize incidents by indicating the level of risk and potential impact associated with the incident. This enables organizations to allocate resources efficiently and address the most critical incidents first.\nCan also be used to generate reports and metrics for measuring the effectiveness of the incident response process and to identify trends and patterns in the threat landscape.\nIt is important to note that the `severity` field is subjective and can be interpreted differently by different organizations or analysts. Therefore, it should be used in conjunction with other intelligence attributes, such as the `confidence` field, to provide a more comprehensive view of the incident."
tactics:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Represents the offensive techniques, approaches, or procedures that an adversary may use to achieve their objectives during an attack. It helps in understanding the intent and capabilities of the adversary and can be used to identify indicators of attack (IoAs) or indicators of compromise (IoCs) that are associated with the adversary's tactics.
techniques:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Represents the specific methods or actions used by an attacker to carry out an offensive maneuver or achieve their goals.
short_id:
type: string
example: string
description: A human-readable, short identifier for the incident, unique within an organization.
required:
- confidence
- status
- incident_time
example:
description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
description: For submitting a new Incident.
uniqueItems: true
example:
- description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
description: a list of `NewIncident`s.
indicators:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- indicator
example: indicator
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which this Indicator is considered valid.
producer:
type: string
example: string
description: String with at most 1024 characters.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
negate:
type: boolean
example: true
description: Specifies the absence of the pattern.
indicator_type:
type: array
items:
type: string
enum:
- Anonymization
- C2
- Compromised PKI Certificate
- Domain Watchlist
- Exfiltration
- File Hash Watchlist
- Host Characteristics
- IMEI Watchlist
- IMSI Watchlist
- IP Watchlist
- Login Name
- Malicious E-mail
- Malware Artifacts
- Private Threat Feed
- URL Watchlist
example: Anonymization
example:
- Anonymization
description: Specifies the type or types for this Indicator.
tags:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: Descriptors for this indicator.
composite_indicator_expression:
type: object
properties:
operator:
type: string
enum:
- and
- not
- or
example: and
indicator_ids:
type: array
items:
type: string
example: string
description: A URI leading to an indicator.
example:
- string
required:
- operator
- indicator_ids
example:
operator: and
indicator_ids:
- string
likely_impact:
type: string
example: string
description: Likely potential impact within the relevant context if this Indicator were to occur.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: level of confidence held in the accuracy of this Indicator.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: Relevant kill chain phases indicated by this Indicator.
test_mechanisms:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
specification:
type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
x-anyOf:
- type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
- type: object
properties:
type:
type: string
enum:
- ThreatBrain
example: ThreatBrain
query:
type: string
example: string
variables:
type: array
items:
type: string
example: string
example:
- string
required:
- type
- variables
example:
type: ThreatBrain
query: string
variables:
- string
description: An indicator which runs in threatbrain...
- type: object
properties:
type:
type: string
enum:
- Snort
example: Snort
snort_sig:
type: string
example: string
required:
- type
- snort_sig
example:
type: Snort
snort_sig: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- SIOC
example: SIOC
SIOC:
type: string
example: string
required:
- type
- SIOC
example:
type: SIOC
SIOC: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- OpenIOC
example: OpenIOC
open_IOC:
type: string
example: string
required:
- type
- open_IOC
example:
type: OpenIOC
open_IOC: string
description: An indicator which contains an XML blob of an openIOC indicator.
required:
- producer
example:
description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: For submitting a new Indicator
uniqueItems: true
example:
- description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: a list of `NewIndicator`s.
judgements:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- judgement
example: judgement
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
disposition:
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Matches :disposition_name as in {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}
disposition_name:
type: string
enum:
- Clean
- Common
- Malicious
- Suspicious
- Unknown
example: Clean
description: String verdict identifiers.
priority:
type: integer
format: int64
example: 10
description: A value 0-100 that determine the priority of a judgement. Curated feeds of black/white lists, for example known good products within your organizations, should use a 95. All automated systems should use a priority of 90, or less. Human judgements should have a priority of 100, so that humans can always override machines.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
reason:
type: string
example: string
description: String with at most 1024 characters.
reason_uri:
type: string
example: string
description: A URI
required:
- source
- observable
- priority
- confidence
- severity
example:
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
description: Schema for submitting new Judgements.
uniqueItems: true
example:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
description: a list of `NewJudgement`s.
malwares:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- malware
example: malware
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
labels:
type: array
items:
type: string
example: adware
description: Malware label is an open vocabulary that represents different types and functions of malware. Malware labels are not mutually exclusive; a malware instance can be both spyware and a screen capture tool.
example:
- adware
description: The type of malware being described.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: The list of Kill Chain Phases for which this Malware can be used.
x_mitre_aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Software.aliases.
abstraction_level:
type: string
enum:
- family
- variant
- version
example: family
description: Malware abstraction level.
required:
- title
- description
- short_description
- labels
example:
description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new Malware.
uniqueItems: true
example:
- description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewMalware`s.
notes:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- note
example: note
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
note_class:
type: string
example: keyword
content:
type: string
example: string
description: Markdown string with at most 5000 characters.
related_entities:
type: array
items:
type: object
properties:
entity_type:
type: string
example: string
entity_id:
type: string
example: string
description: A URI leading to an entity.
required:
- entity_type
- entity_id
example:
entity_type: string
entity_id: string
example:
- entity_type: string
entity_id: string
author:
type: string
example: string
required:
- note_class
- content
- related_entities
example:
schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
description: Schema for submitting Notes
uniqueItems: true
example:
- schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
description: a list of `NewNote`s.
relationships:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- relationship
example: relationship
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
relationship_type:
type: string
example: attributed-to
source_ref:
type: string
example: string
description: A URI leading to an entity.
target_ref:
type: string
example: string
description: A URI leading to an entity.
required:
- relationship_type
- source_ref
- target_ref
example:
description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
description: Schema for submitting new Relationships.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
description: a list of `NewRelationship`s.
sightings:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- sighting
example: sighting
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
count:
type: integer
format: int64
example: 10
description: 'The number of times an indicator was observed within a certain period of time.
For example, if an IP address associated with known malicious activity is observed once within a period of time, it may indicate a low-level threat. However, if the same IP address is observed multiple times within a short time frame, it may indicate a more severe and persistent threat.
It can also be used to prioritize security alerts and indicate the urgency of a response. High counts indicate that an indicator is actively being used in a larger campaign, while low counts may indicate isolated incidents.'
internal:
type: boolean
example: false
description: "If `true`, indicates that the sighting was reported from internal sources, such as an organization's own internal security tools or SOC.\n Internal sightings are often considered more reliable and actionable than external sightings, which are reported from external sources and may have a lower level of trustworthiness. Internal sightings can provide more context and can help identify potential threats that are unique to a particular environment or organization.\n Internal sightings can also help organizations prioritize their security response efforts by identifying threats that are specific to their environment and may not yet be widely known."
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
resolution:
type: string
example: detected
description: Represents the disposition or actions taken on the associated threat intelligence.
data:
type: object
properties:
columns:
type: array
items:
type: object
properties:
name:
type: string
example: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
example: integer
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
type: boolean
example: true
description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`.
short_description:
type: string
example: string
required:
- name
- type
example:
name: string
type: integer
description: string
required: true
short_description: string
example:
- name: string
type: integer
description: string
required: true
short_description: string
description: an ordered list of column definitions
rows:
type: array
items:
type: array
items:
example: anything
example:
- - anything
description: an ordered list of rows
row_count:
type: integer
format: int64
example: 10
description: The number of rows in the data table.
required:
- columns
- rows
example:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: An embedded data table for the Sighting.
sensor:
type: string
example: endpoint
description: The OpenC2 Actuator name that best fits the device that is creating this sighting (e.g. network.firewall)
sensor_coordinates:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
os:
type: string
example: string
required:
- type
- observables
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
description: Describes the device that made the sighting (sensor) and contains identifying observables for the sensor.
targets:
type: array
items:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
os:
type: string
example: string
required:
- type
- observables
- observed_time
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
description: Describes the target of the sighting and contains identifying observables for the target.
example:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
description: 'May include one or more targets that observed the associated indicator. Targets can include network devices, host devices, or other entities that are capable of detecting indicators of compromise.
Can be used to assess the scope of potential threats, helping analysts understand which devices or components of the network may be vulnerable to attack. For example, if a particular malware strain is detected on several different systems within an organization, the `targets` field may indicate which systems are affected and which may need to be isolated or patched to prevent further spread.'
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
description: The object(s) of interest.
relations:
type: array
items:
type: object
properties:
origin:
type: string
example: string
origin_uri:
type: string
example: string
description: A URI
relation:
type: string
example: Allocated
relation_info:
type: object
additionalProperties:
example: anything
example:
keyword: anything
properties: {}
source:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
related:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
required:
- origin
- relation
- source
- related
example:
origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
description: A relation inside a Sighting.
example:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
description: Provide any context we can about where the observable came from.
context:
type: object
properties:
process_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- ProcessCreateEvent
example: ProcessCreateEvent
process_args:
type: string
example: string
description: String with at most 2048 characters.
process_hash:
type: string
example: string
description: String with at most 2048 characters.
process_size:
type: integer
format: int64
example: 10
process_disposition:
type: string
example: string
description: String with at most 1024 characters.
parent_creation_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
parent_process_id:
type: integer
format: int64
example: 10
parent_process_guid:
type: integer
format: int64
example: 10
parent_process_name:
type: string
example: string
description: String with at most 1024 characters.
parent_process_args:
type: string
example: string
description: String with at most 2048 characters.
parent_process_username:
type: string
example: string
description: String with at most 1024 characters.
parent_process_hash:
type: string
example: string
description: String with at most 2048 characters.
parent_process_size:
type: integer
format: int64
example: 10
parent_process_disposition:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- type
example:
parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
example:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
description: a list of `ProcessCreate`
library_load_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- LibraryLoadEvent
example: LibraryLoadEvent
dll_library_name:
type: string
example: string
description: String with at most 1024 characters.
dll_library_path:
type: string
example: string
description: String with at most 2048 characters.
required:
- time
- process_id
- process_name
- type
- dll_library_name
- dll_library_path
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
description: a list of `LibraryLoadType`
file_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileCreateEvent
example: FileCreateEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileCreateType`
file_delete_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileDeleteEvent
example: FileDeleteEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileDeleteType`
file_modify_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileModifyEvent
example: FileModifyEvent
failed:
type: boolean
example: false
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
description: a list of `FileModifyType`
file_move_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
file_name:
type: string
example: string
description: String with at most 1024 characters.
file_path:
type: string
example: string
description: String with at most 2048 characters.
type:
type: string
enum:
- FileMoveEvent
example: FileMoveEvent
old_name:
type: string
example: string
description: String with at most 1024 characters.
new_name:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- file_name
- file_path
- type
- old_name
- new_name
example:
file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
example:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
description: a list of `FileMoveType`
netflow_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- NetflowEvent
example: NetflowEvent
traffic:
type: object
properties:
protocol:
type: integer
format: int64
example: 10
description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
source_ip:
type: string
example: string
destination_ip:
type: string
example: string
source_port:
type: integer
format: int64
example: 10
destination_port:
type: integer
format: int64
example: 10
direction:
type: string
enum:
- incoming
- outgoing
example: incoming
destination_host_name:
type: string
example: string
source_subnet:
type: string
example: string
destination_subnet:
type: string
example: string
required:
- protocol
- source_ip
- destination_ip
- source_port
- destination_port
- direction
example:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
process_path:
type: string
example: string
description: String with at most 1024 characters.
process_args:
type: string
example: string
description: String with at most 1024 characters.
process_hash:
type: string
example: string
description: String with at most 1024 characters.
process_account_type:
type: string
example: string
description: String with at most 1024 characters.
process_account:
type: string
example: string
description: String with at most 1024 characters.
parent_process_id:
type: integer
format: int64
example: 10
parent_process_name:
type: string
example: string
description: String with at most 1024 characters.
parent_process_path:
type: string
example: string
description: String with at most 1024 characters.
parent_process_args:
type: string
example: string
description: String with at most 1024 characters.
parent_process_hash:
type: string
example: string
description: String with at most 1024 characters.
parent_process_account:
type: string
example: string
description: String with at most 1024 characters.
parent_process_account_type:
type: string
example: string
description: String with at most 1024 characters.
flow_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
byte_count_out:
type: integer
format: int64
example: 10
byte_count_in:
type: integer
format: int64
example: 10
required:
- time
- process_id
- process_name
- type
- traffic
example:
parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
example:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
description: a list of `NetflowType`
http_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- HTTPEvent
example: HTTPEvent
host:
type: string
example: string
description: String with at most 1024 characters.
traffic:
type: object
properties:
protocol:
type: integer
format: int64
example: 10
description: The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
source_ip:
type: string
example: string
destination_ip:
type: string
example: string
source_port:
type: integer
format: int64
example: 10
destination_port:
type: integer
format: int64
example: 10
direction:
type: string
enum:
- incoming
- outgoing
example: incoming
destination_host_name:
type: string
example: string
source_subnet:
type: string
example: string
destination_subnet:
type: string
example: string
required:
- protocol
- source_ip
- destination_ip
- source_port
- destination_port
- direction
example:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
url_port:
type: integer
format: int64
example: 10
query:
type: string
example: string
description: String with at most 5000 characters.
encrypted:
type: boolean
example: true
method:
type: string
enum:
- CONNECT
- GET
- HEAD
- OPTIONS
- PATCH
- POST
- PUT
- TRACE
example: CONNECT
required:
- time
- process_id
- process_name
- type
- host
- traffic
example:
process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
example:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
description: a list of `HTTPType`
registry_create_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryCreateEvent
example: RegistryCreateEvent
required:
- time
- process_id
- process_name
- registry_key
- type
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
description: a list of `RegistryCreateType`
registry_set_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistrySetEvent
example: RegistrySetEvent
registry_value:
type: string
example: string
description: String with at most 2048 characters.
registry_data_length:
type: integer
format: int64
example: 10
registry_data:
type: string
example: string
description: String with at most 5000 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
- registry_value
example:
process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
example:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
description: a list of `RegistrySetType`
registry_delete_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryDeleteEvent
example: RegistryDeleteEvent
registry_value:
type: string
example: string
description: String with at most 2048 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
description: a list of `RegistryDeleteType`
registry_rename_events:
type: array
items:
type: object
properties:
time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
process_id:
type: integer
format: int64
example: 10
process_name:
type: string
example: string
description: String with at most 1024 characters.
process_guid:
type: integer
format: int64
example: 10
process_username:
type: string
example: string
description: String with at most 1024 characters.
registry_key:
type: string
example: string
description: String with at most 1024 characters.
type:
type: string
enum:
- RegistryRenameEvent
example: RegistryRenameEvent
registry_old_key:
type: string
example: string
description: String with at most 1024 characters.
required:
- time
- process_id
- process_name
- registry_key
- type
- registry_old_key
example:
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
example:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
description: a list of `RegistryRenameType`
example:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
description: Context including the event type that best fits the type of the sighting.
activity_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the malicious activity occurred. For example, the time when a malware sample was executing, or the time range of a network intrusion.
detection_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the malicious activity was detected by the source engine or security tool. This may differ from the activity_interval if detection occurred after the activity.
modification_interval:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time interval during which the sighting record was created or last updated in the system.
required:
- observed_time
example:
description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: For submitting a new Sighting.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
description: a list of `NewSighting`s.
identity_assertions:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- identity-assertion
example: identity-assertion
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
identity:
type: object
properties:
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
required:
- observables
example:
observables:
- value: 1.2.3.4
type: ip
description: Attributes for which the assertion is being made.
assertions:
type: array
items:
type: object
properties:
name:
type: string
example: cisco:ctr:ad:host_domain_name
description: An open vocabulary containing well known assertion types
value:
type: string
example: string
required:
- name
- value
example:
name: cisco:ctr:ad:host_domain_name
value: string
example:
- name: cisco:ctr:ad:host_domain_name
value: string
description: Any known context about the identity attributes.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- identity
- assertions
example:
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
description: For submitting a new IdentityAssertion.
uniqueItems: true
example:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
description: a list of `NewIdentityAssertion`s.
target_records:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- target-record
example: target-record
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
targets:
type: array
items:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
os:
type: string
example: string
description: Source Operating System where TargetRecord was originated.
internal:
type: boolean
example: false
description: Is it internal to our network?
sensor:
type: string
example: string
description: 'The OpenC2 Actuator name that best fits the device that is creating this TargetRecord (e.g.: network.firewall, etc.)'
source_uri:
type: string
example: string
description: A URI
required:
- type
- observables
- observed_time
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
description: Schema for TargetRecord Targets
example:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
required:
- source
- targets
example:
description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting new TargetRecord.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewTargetRecord`s.
tools:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- tool
example: tool
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
labels:
type: array
items:
type: string
example: credential-exploitation
description: Tool labels describe the categories of tools that can be used to perform attacks.
example:
- credential-exploitation
description: The kind(s) of tool(s) being described.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: The list of kill chain phases for which this Tool can be used.
tool_version:
type: string
example: string
description: The version identifier associated with the Tool.
x_mitre_aliases:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- string
description: ATT&CK Software.aliases.
required:
- title
- description
- short_description
- labels
example:
description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: For submitting a new Tool.
uniqueItems: true
example:
- description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewTool`s.
verdicts:
type: array
items:
type: object
properties:
type:
type: string
enum:
- verdict
example: verdict
disposition:
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Numeric verdict identifiers.
observable:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
disposition_name:
type: string
enum:
- Clean
- Common
- Malicious
- Suspicious
- Unknown
example: Clean
description: 'The disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}'
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- type
- disposition
- observable
- valid_time
example:
type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: "A Verdict is chosen from all of the Judgements on that Observable which have not yet expired. The highest priority Judgement becomes the active verdict. If there is more than one Judgement with that priority, then Clean disposition has priority over all others, then Malicious disposition, and so on down to Unknown.\n\n The ID of a verdict is a a str of the form \"observable.type:observable.value\" for example, \"ip:1.1.1.1\""
uniqueItems: true
example:
- type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: a list of `Verdict`s.
data_tables:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- data-table
example: data-table
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: A description of object, which may be detailed.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
columns:
type: array
items:
type: object
properties:
name:
type: string
example: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
example: integer
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
type: boolean
example: true
description: If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`.
short_description:
type: string
example: string
required:
- name
- type
example:
name: string
type: integer
description: string
required: true
short_description: string
example:
- name: string
type: integer
description: string
required: true
short_description: string
description: An ordered list of column definitions.
rows:
type: array
items:
type: array
items:
example: anything
example:
- - anything
description: An ordered list of rows
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
row_count:
type: integer
format: int64
example: 10
description: The number of rows in the data table.
required:
- columns
- rows
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
description: Schema for submitting a NewDataTable record.
uniqueItems: true
example:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
description: a list of `NewDataTable`s.
weaknesses:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- weakness
example: weakness
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: Should be short and limited to the key points that define this weakness.
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
structure:
type: string
enum:
- Chain
- Composite
- Simple
example: Chain
description: Defines the structural nature of the weakness.
languages:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Language name (Clojure, Java, ...)
class:
type: string
example: Assembly
description: Class of language.
required:
- prevalence
example:
prevalence: Often
name: string
class: Assembly
example:
- prevalence: Often
name: string
class: Assembly
description: Applicable Languages.
operating_systems:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: String with at most 1024 characters.
version:
type: string
example: string
description: String with at most 1024 characters.
cpe_id:
type: string
example: string
description: String with at most 1024 characters.
class:
type: string
example: Android
description: Class of Operating System.
required:
- prevalence
example:
prevalence: Often
name: string
version: string
cpe_id: string
class: Android
example:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
description: Applicable operating systems.
architectures:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Architecture name (ARM, x86, ...)
class:
type: string
example: Embedded
description: Class of architecture
required:
- prevalence
example:
prevalence: Often
name: string
class: Embedded
example:
- prevalence: Often
name: string
class: Embedded
description: Applicable architectures.
paradigms:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Paradigm name (Client Server, Mainframe)
required:
- prevalence
example:
prevalence: Often
name: string
example:
- prevalence: Often
name: string
description: Applicable paradigms.
technologies:
type: array
items:
type: object
properties:
prevalence:
type: string
enum:
- Often
- Rarely
- Sometimes
- Undetermined
example: Often
description: Defines the different regularities that guide the applicability of platforms.
name:
type: string
example: string
description: Technology name (Web Server, Web Client)
required:
- prevalence
example:
prevalence: Often
name: string
example:
- prevalence: Often
name: string
description: Applicable technologies.
background_details:
type: string
example: string
description: Information that is relevant but not related to the nature of the weakness itself.
alternate_terms:
type: array
items:
type: object
properties:
term:
type: string
example: string
description: The actual alternate term.
description:
type: string
example: string
description: Provides context for the alternate term by which this weakness may be known.
required:
- term
example:
term: string
description: string
example:
- term: string
description: string
description: Indicates one or more other names used to describe this weakness.
modes_of_introduction:
type: array
items:
type: object
properties:
phase:
type: string
example: Architecture and Design
description: Identifies the point in the software life cycle at which the weakness may be introduced.
note:
type: string
example: string
description: Provides a typical scenario related to introduction during the given phase.
required:
- phase
example:
phase: Architecture and Design
note: string
example:
- phase: Architecture and Design
note: string
description: Information about how and when a given weakness may be introduced.
likelihood:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: Likelihood of exploit.
common_consequences:
type: array
items:
type: object
properties:
scopes:
type: array
items:
type: string
example: Access Control
description: Defines the different areas of software security that can be affected by exploiting a weakness.
example:
- Access Control
description: Identifies the security property that is violated.
impacts:
type: array
items:
type: string
example: Alter Execution Logic
example:
- Alter Execution Logic
description: Describes the technical impact that arises if an adversary succeeds in exploiting this weakness.
likelihood:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: How likely the specific consequence is expected to be seen relative to the other consequences.
note:
type: string
example: string
description: Additional commentary about a consequence.
required:
- scopes
example:
scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
example:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
description: Refers to the typical or expected negative effects that can result from exploiting the weakness. This could include anything from unauthorized access to data, denial of service, system crashes or other things.
detection_methods:
type: array
items:
type: object
properties:
method:
type: string
example: Architecture or Design Review
description: Identifies the particular detection method being described.
description:
type: string
example: string
description: Provides some context of how this method can be applied to a specific weakness.
effectiveness:
type: string
example: High
description: How effective the detection method may be in detecting the associated weakness.
effectiveness_notes:
type: string
example: string
description: Provides additional discussion of the strengths and shortcomings of this detection method.
required:
- method
- description
example:
method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
example:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
description: Identifies methods that may be employed to detect this weakness, including their strengths and limitations.
potential_mitigations:
type: array
items:
type: object
properties:
description:
type: string
example: string
description: A description of this individual mitigation including any strengths and shortcomings of this mitigation for the weakness.
phases:
type: array
items:
type: string
example: Architecture and Design
description: Defines the different regularities that guide the applicability of platforms.
example:
- Architecture and Design
description: Indicates the development life cycle phase during which this particular mitigation may be applied.
strategy:
type: string
example: Attack Surface Reduction
description: A general strategy for protecting a system to which this mitigation contributes.
effectiveness:
type: string
example: Defense in Depth
description: Summarizes how effective the mitigation may be in preventing the weakness.
effectiveness_notes:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
- description
example:
description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
example:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
description: Describes potential mitigations associated with a weakness.
functional_areas:
type: array
items:
type: string
example: Authentication
description: Defines the different functional areas of software in which the weakness may appear.
example:
- Authentication
description: Identifies the functional area of the software in which the weakness is most likely to occur.
affected_resources:
type: array
items:
type: string
example: CPU
description: Defines a resource of a system.
example:
- CPU
description: Identifies system resources that can be affected by an exploit of this weakness.
notes:
type: array
items:
type: object
properties:
type:
type: string
example: Applicable Platform
description: Defines the different types of notes that can be associated with a weakness.
note:
type: string
example: string
description: Markdown string with at most 5000 characters.
required:
- type
- note
example:
type: Applicable Platform
note: string
example:
- type: Applicable Platform
note: string
description: Provides any additional comments about the weakness.
abstraction_level:
type: string
enum:
- Base
- Class
- Compound
- Variant
example: Base
description: Refers to the level of abstraction or granularity used to describe the weakness. It helps to categorize the vulnerability based on the level of detail provided.
required:
- description
example:
description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
description: For submitting a new weakness.
uniqueItems: true
example:
- description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
description: a list of `NewWeakness`s.
vulnerabilities:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- vulnerability
example: vulnerability
description: A valid entity type identifer
schema_version:
type: string
enum:
- 1.3.30
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type: string
example: string
description: "Various sources of vulnerability information can be used, including third-party resources like the National Vulnerability Database (NVD) and the Common Vulnerabilities and Exposures (CVE) database. The platform then analyzes this data and provides the user with relevant details such as the severity of the vulnerability, the affected systems, and remediation recommendations. \n\n Based on this information, the user can prioritize patching and other mitigation strategies to reduce the risk of potential attacks."
short_description:
type: string
example: string
description: A single line, short summary of the object.
source:
type: string
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type: string
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
cve:
type: object
properties:
cve_data_meta:
type: object
properties:
id:
type: string
example: string
description: String with at most 1024 characters.
assigner:
type: string
example: string
description: String with at most 1024 characters.
example:
id: string
assigner: string
required:
- cve_data_meta
example:
cve_data_meta:
id: string
assigner: string
impact:
type: object
properties:
cvss_v2:
type: object
properties:
vector_string:
type: string
example: string
description: a text representation of a set of CVSSv2 metrics. It is commonly used to record or transfer CVSSv2 metric information in a concise form
base_score:
type: number
format: double
example: 10.0
description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v2/guide'
base_severity:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
impact_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
exploitability_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
access_vector:
type: string
enum:
- adjacent network
- local
- network
example: network
description: This metric reflects how the vulnerability is exploited.The more remote an attacker can be to attack a host, the greater the vulnerability score.
access_complexity:
type: string
enum:
- high
- low
- medium
example: low
description: 'This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system. For example, consider a buffer overflow in an Internet service: once the target system is located, the attacker can launch an exploit at will.'
authentication:
type: string
enum:
- multiple
- none
- single
example: none
description: This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. This metric does not gauge the strength or complexity of the authentication process, only that an attacker is required to provide credentials before an exploit may occur. The fewer authentication instances that are required, the higher the vulnerability score.
confidentiality_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact on confidentiality of a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. Increasedconfidentiality impact increases the vulnerability score.
integrity_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information. Increased integrity impact increases the vulnerability score.
availability_impact:
type: string
enum:
- complete
- none
- partial
example: complete
description: This metric measures the impact to availability of a successfully exploited vulnerability. Availability refers to the accessibility of information resources. Attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system. Increased availability impact increases the vulnerability score.
exploitability:
type: string
enum:
- functional
- high
- not_defined
- proof_of_concept
- unproven
example: not_defined
description: This metric measures the current state of exploit techniques or code availability. Public availability of easy-to-use exploit code increases the number of potential attackers by including those who are unskilled thereby increasing the severity of the vulnerability.
remediation_level:
type: string
enum:
- not_defined
- official_fix
- temporary_fix
- unavailable
- workaround
example: not_defined
description: The remediation level of a vulnerability is an important factor for prioritization. The typical vulnerability is unpatched when initially published. Workarounds or hotfixes may offer interim remediation until an official patch or upgrade is issued. Each of these respective stages adjusts the temporal score downwards, reflecting the decreasing urgency as remediation becomes final. The less official and permanent a fix, the higher the vulnerability score is.
report_confidence:
type: string
enum:
- confirmed
- not_defined
- unconfirmed
- uncorroborated
example: not_defined
description: This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details. Sometimes, only the existence of vulnerabilities are publicized, but without specific details. The vulnerability may later be corroborated and then confirmed through acknowledgement by the author or vendor of the affected technology. The urgency of a vulnerability is higher when a vulnerability is known to exist with certainty. This metric also suggests the level of technical knowledge available to would-be attackers. The more a vulnerability is validated by the vendor or other reputable sources, the higher the score.
temporal_vector_string:
type: string
example: string
description: A text representation of a set of CVSSv2 temporal metrics. Temporal metrics allow analysists to calculate threat severity based on temporal factors such as reliability of vulnerability reports, availability of mitigations, and the ease or difficulty of conducting the exploit. It is commonly used to record or transfer CVSSv2 metric information in a concise form
collateral_damage_potential:
type: string
enum:
- high
- low
- low_medium
- medium_high
- none
- not_defined
example: not_defined
description: This metric measures the potential for loss of life or physical assets through damage or theft of property or equipment. The metric may also measure economic loss of productivity or revenue. Naturally, the greater the damage potential, the higher the vulnerability score.
target_distribution:
type: string
enum:
- high
- low
- medium
- none
- not_defined
example: not_defined
description: This metric measures the proportion of vulnerable systems. It is meant as an environment-specific indicator in order to approximate the percentage of systems that could be affected by the vulnerability. The greater the proportion of vulnerable systems, the higher the score.
confidentiality_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
integrity_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
availability_requirement:
type: string
enum:
- high
- low
- medium
- not_defined
example: not_defined
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high.'
environmental_vector_string:
type: string
example: string
description: A text representation of a set of CVSSv2 environmental metrics. Environmental metrics allow analysists to calculate threat scores in relation to environmental security requirements, collateral damage potential, and target availability. It is commonly used to record or transfer CVSSv2 metric information in a concise form
obtain_all_privilege:
type: boolean
example: true
obtain_user_privilege:
type: boolean
example: true
obtain_other_privilege:
type: boolean
example: true
user_interaction_required:
type: boolean
example: true
required:
- vector_string
- base_score
- base_severity
example:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
type: object
properties:
vector_string:
type: string
example: string
description: a text representation of a set of CVSSv3 metrics. It is commonly used to record or transfer CVSSv3 metric information in a concise form
base_score:
type: number
format: double
example: 10.0
description: 'The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v3-1'
base_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
impact_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
exploitability_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
attack_vector:
type: string
enum:
- adjacent_network
- local
- network
- physical
example: adjacent_network
description: Reflects the context by which vulnerability exploitation is possible
modified_attack_vector:
type: string
enum:
- adjacent_network
- local
- network
- not_defined
- physical
example: not_defined
description: modified attack vector
attack_complexity:
type: string
enum:
- high
- low
example: high
description: describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability
modified_attack_complexity:
type: string
enum:
- high
- low
- not_defined
example: not_defined
description: modified attack complexity
privileges_required:
type: string
enum:
- high
- low
- none
example: high
description: describes the level of privileges an attacker must possess before successfully exploiting the vulnerability
modified_privileges_required:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified privileges required
user_interaction:
type: string
enum:
- none
- required
example: none
description: captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component
modified_user_interaction:
type: string
enum:
- none
- not_defined
- required
example: none
description: modified user interaction
scope:
type: string
enum:
- changed
- unchanged
example: changed
description: the ability for a vulnerability in one software component to impact resources beyond its means, or privileges
modified_scope:
type: string
enum:
- changed
- not_defined
- unchanged
example: not_defined
description: modified scope
confidentiality_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability
modified_confidentiality_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified confidentiality impact
integrity_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to integrity of a successfully exploited vulnerability
modified_integrity_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified integrity impact
availability_impact:
type: string
enum:
- high
- low
- none
example: high
description: measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability
modified_availability_impact:
type: string
enum:
- high
- low
- none
- not_defined
example: not_defined
description: modified availability impact
exploit_code_maturity:
type: string
enum:
- functional
- high
- not_defined
- proof_of_concept
- unproven
example: functional
description: measures the likelihood of the vulnerability being attacked
remediation_level:
type: string
enum:
- high
- not_defined
- offical_fix
- temporary_fix
- unavailable
- workaround
example: high
description: Remediation Level of a vulnerability is an important factor for prioritization
report_confidence:
type: string
enum:
- confirmed
- reasonable
- unknown
example: confirmed
description: measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details
temporal_score:
type: number
format: double
example: 10.0
description: Round up(CVSSv3BaseScore × CVSSv3ExploitCodeMaturity × CVSSv3RemediationLevel × CVSSv3ReportConfidence)
temporal_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
description: temporal severity
availability_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
confidentiality_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
integrity_requirement:
type: string
enum:
- high
- low
- none
- not_defined
example: high
description: 'These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user''s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default).'
environmental_score:
type: number
format: double
example: 10.0
description: a Score number from 0 to 10
environmental_severity:
type: string
enum:
- critical
- high
- low
- medium
- none
example: critical
required:
- vector_string
- base_score
- base_severity
example:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
example:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: "Describes the potential impact of a vulnerability that is being tracked in the system. Provides information on the extent of damage that a vulnerability can cause and how serious the consequences could be if it is exploited. \n\nMay contain granular information about the vulnerability severity using the CVSS system, versions 2 and 3.\n\nCVSSv2 and CVSSv3 have different methods of calculating base scores, but both are designed to provide an indication of the level of risk that a vulnerability poses. The base score ranges from 0 to 10, with 10 being the most severe. Additionally, both CVSSv2 and CVSSv3 define severity levels, such as low, medium, high, and critical, based on the base score."
configurations:
type: object
properties:
CVE_data_version:
type: string
example: string
description: Specifies the version of the CVE (Common Vulnerabilities and Exposures) dictionary used by the vulnerability information provider.
nodes:
type: array
items:
type: object
properties:
operator:
type: string
enum:
- AND
- OR
example: AND
description: The operator string influences how seqs of cpe matches are related to one another.
cpe_match:
type: array
items:
type: object
properties:
vulnerable:
type: boolean
example: true
cpe23Uri:
type: string
example: string
description: A text representation of a software or hardware platform.
versionStartIncluding:
type: string
example: string
description: A string representing the lower bound(inclusive) of version in the CPE.
versionEndIncluding:
type: string
example: string
description: A string representing the upper bound(inclusive) of version in the CPE.
versionStartExcluding:
type: string
example: string
description: A string representing the lower bound(exclusive) of version in the CPE.
versionEndExcluding:
type: string
example: string
description: A string representing the upper bound(exclusive) of version in the CPE.
required:
- vulnerable
- cpe23Uri
example:
vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
example:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
type: array
items:
type: object
properties:
operator:
type: string
enum:
- AND
- OR
example: AND
description: The operator string influences how seqs of cpe matches are related to one another.
cpe_match:
type: array
items:
type: object
properties:
vulnerable:
type: boolean
example: true
cpe23Uri:
type: string
example: string
description: A text representation of a software or hardware platform.
versionStartIncluding:
type: string
example: string
description: A string representing the lower bound(inclusive) of version in the CPE.
versionEndIncluding:
type: string
example: string
description: A string representing the upper bound(inclusive) of version in the CPE.
versionStartExcluding:
type: string
example: string
description: A string representing the lower bound(exclusive) of version in the CPE.
versionEndExcluding:
type: string
example: string
description: A string representing the upper bound(exclusive) of version in the CPE.
required:
- vulnerable
- cpe23Uri
example:
vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
example:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate:
type: boolean
example: true
description: Negates operator when true.
required:
- operator
- cpe_match
example:
operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
example:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate:
type: boolean
example: true
description: Negates operator when true.
required:
- operator
example:
operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
example:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
description: Each `node` in the CTIM standard configuration includes information such as the `operator` (such as "less than", or "greater than or equal to"), and the `cpe` (Common Platform Enumeration) string which identifies the specific software, `CPE` is a structured naming scheme for IT systems, platforms, and software packages, and it is instrumental in enabling data exchange between different systems.
required:
- CVE_data_version
- nodes
example:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
description: "Represents a list of affected versions or configurations of a software component that is impacted by a vulnerability. \nBy tracking the affected software components and versions, defenders can identify which systems are potentially exposed to an attack, and apply appropriate mitigations."
published_date:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: "Represents the date when a vulnerability was publicly disclosed or made available to the general public. \n\nImportant for tracking the age of a vulnerability, as well as for determining when a particular vulnerability was first introduced into a system. The published date can be used to identify the time window during which a system may have been vulnerable to a particular exploit.\n\nFor example, if an organization discovers that a vulnerability was published before their system's installation date, but they did not apply the necessary security updates in a timely manner, it can be concluded that their system was vulnerable for the period between the installation date and the date when the necessary security updates were applied."
last_modified_date:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: 'Represents the date when the vulnerability metadata was last updated in the internal database.
It can be used to track the freshness of the vulnerability information. If the `last_modified_date` is more recent than the `published_date`, it can indicate that there has been some new information or updates related to the vulnerability, such as new patch releases or changes in the severity or impact rating.'
required:
- description
example:
description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: For submitting a new vulnerability.
uniqueItems: true
example:
- description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
description: a list of `NewVulnerability`s.
actor_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_mapping_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
asset_properties_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
attack_pattern_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
campaign_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
coa_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
feedback_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
identity_assertion_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
incident_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
indicator_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
judgement_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
malware_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
note_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
relationship_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
sighting_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
target_record_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
tool_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
verdict_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
data_table_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
weakness_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
vulnerability_refs:
type: array
items:
type: string
example: string
description: A URI leading to an entity.
uniqueItems: true
example:
- string
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid.
required:
- source
example:
description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
asset_mapping_refs:
- string
note_refs:
- string
data_table_refs:
- string
attack_pattern_refs:
- string
sighting_refs:
- string
schema_version: 1.3.30
revision: 10
assets:
- description: string
asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: asset
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
weakness_refs:
- string
tool_refs:
- string
target_record_refs:
- string
asset_refs:
- string
tools:
- description: string
labels:
- credential-exploitation
schema_version: 1.3.30
revision: 10
type: tool
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tool_version: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
indicators:
- description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
attack_patterns:
- description: string
abstraction_level: aggregate
schema_version: 1.3.30
revision: 10
type: attack-pattern
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
x_mitre_platforms:
- string
language: string
id: string
tlp: green
x_mitre_data_sources:
- string
kill_chain_phases:
- kill_chain_name: string
phase_name: string
x_mitre_contributors:
- string
timestamp: '2016-01-01T01:01:01Z'
type: bundle
weaknesses:
- description: string
background_details: string
paradigms:
- prevalence: Often
name: string
abstraction_level: Base
architectures:
- prevalence: Often
name: string
class: Embedded
schema_version: 1.3.30
revision: 10
alternate_terms:
- term: string
description: string
likelihood: High
type: weakness
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
functional_areas:
- Authentication
source_uri: string
modes_of_introduction:
- phase: Architecture and Design
note: string
structure: Chain
language: string
id: string
notes:
- type: Applicable Platform
note: string
common_consequences:
- scopes:
- Access Control
impacts:
- Alter Execution Logic
likelihood: High
note: string
tlp: green
detection_methods:
- method: Architecture or Design Review
description: string
effectiveness: High
effectiveness_notes: string
operating_systems:
- prevalence: Often
name: string
version: string
cpe_id: string
class: Android
affected_resources:
- CPU
languages:
- prevalence: Often
name: string
class: Assembly
timestamp: '2016-01-01T01:01:01Z'
potential_mitigations:
- description: string
phases:
- Architecture and Design
strategy: Attack Surface Reduction
effectiveness: Defense in Depth
effectiveness_notes: string
technologies:
- prevalence: Often
name: string
source: string
external_ids:
- string
feedback_refs:
- string
asset_properties:
- properties:
- name: string
value: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
asset_ref: string
type: asset-properties
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
short_description: string
feedbacks:
- feedback: -1
schema_version: 1.3.30
revision: 10
type: feedback
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
language: string
id: string
tlp: green
entity_id: string
timestamp: '2016-01-01T01:01:01Z'
judgement_refs:
- string
title: string
coa_refs:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
verdicts:
- type: verdict
disposition: 1
observable:
value: 1.2.3.4
type: ip
judgement_id: string
disposition_name: Clean
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
campaigns:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
type: campaign
campaign_type: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
activity:
- date_time: '2016-01-01T01:01:01Z'
description: string
source_uri: string
intended_effect:
- Account Takeover
status: Future
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
names:
- string
source_uri: string
actors:
- description: string
motivation: Ego
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
description: string
related_identities:
- identity: string
confidence: High
information_source: string
relationship: string
sophistication: Aspirant
schema_version: 1.3.30
revision: 10
planning_and_operational_support: string
type: actor
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
intended_effect: Account Takeover
language: string
id: string
tlp: green
aliases:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
actor_types:
- Cyber Espionage Operations
indicator_refs:
- string
actor_refs:
- string
language: string
data_tables:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
columns:
- name: string
type: integer
description: string
required: true
short_description: string
type: data-table
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
rows:
- - anything
source_uri: string
language: string
id: string
tlp: green
row_count: 10
timestamp: '2016-01-01T01:01:01Z'
id: string
notes:
- schema_version: 1.3.30
revision: 10
content: string
note_class: keyword
type: note
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
author: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
related_entities:
- entity_type: string
entity_id: string
identity_assertions:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
identity:
observables:
- value: 1.2.3.4
type: ip
schema_version: 1.3.30
revision: 10
type: identity-assertion
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
assertions:
- name: cisco:ctr:ad:host_domain_name
value: string
judgements:
- valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
reason_uri: string
type: judgement
source: string
external_ids:
- string
disposition: 1
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
reason: string
source_uri: string
disposition_name: Clean
priority: 10
language: string
id: string
severity: Critical
tlp: green
timestamp: '2016-01-01T01:01:01Z'
confidence: High
malwares:
- description: string
labels:
- adware
abstraction_level: family
schema_version: 1.3.30
revision: 10
type: malware
x_mitre_aliases:
- string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
timestamp: '2016-01-01T01:01:01Z'
target_records:
- description: string
schema_version: 1.3.30
revision: 10
type: target-record
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
internal: false
sensor: string
source_uri: string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
asset_mappings:
- asset_type: application
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stability: Managed
schema_version: 1.3.30
revision: 10
observable:
value: 1.2.3.4
type: ip
asset_ref: string
type: asset-mapping
source: string
external_ids:
- string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
specificity: Low
confidence: High
relationship_refs:
- string
tlp: green
incidents:
- description: string
assignees:
- string
detection_sources:
- string
meta:
keyword: string
schema_version: 1.3.30
revision: 10
type: incident
source: string
external_ids:
- string
short_description: string
title: string
incident_time:
opened: '2016-01-01T01:01:01Z'
discovered: '2016-01-01T01:01:01Z'
reported: '2016-01-01T01:01:01Z'
remediated: '2016-01-01T01:01:01Z'
closed: '2016-01-01T01:01:01Z'
rejected: '2016-01-01T01:01:01Z'
contained: '2016-01-01T01:01:01Z'
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
discovery_method: Agent Disclosure
source_uri: string
intended_effect: Account Takeover
categories:
- Attrition
status: Closed
language: string
detection_status: active
id: string
promotion_method: Automated
severity: Critical
tlp: green
scores:
asset: 10.0
techniques:
- string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
short_id: string
tactics:
- string
identity_assertion_refs:
- string
sightings:
- description: string
schema_version: 1.3.30
revision: 10
relations:
- origin: string
origin_uri: string
relation: Allocated
relation_info:
keyword: anything
source:
value: 1.2.3.4
type: ip
related:
value: 1.2.3.4
type: ip
sensor_coordinates:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
os: string
observables:
- value: 1.2.3.4
type: ip
type: sighting
source: string
external_ids:
- string
targets:
- type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
short_description: string
title: string
resolution: detected
internal: false
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
detection_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
source_uri: string
activity_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
language: string
id: string
count: 10
severity: Critical
tlp: green
modification_interval:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
context:
http_events:
- process_guid: 10
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
method: CONNECT
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: HTTPEvent
host: string
process_name: string
process_id: 10
process_username: string
query: string
encrypted: true
url_port: 10
process_create_events:
- parent_process_name: string
process_guid: 10
parent_process_guid: 10
process_disposition: string
parent_process_size: 10
process_size: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_disposition: string
type: ProcessCreateEvent
parent_process_username: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
parent_creation_time: '2016-01-01T01:01:01Z'
process_args: string
registry_delete_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryDeleteEvent
registry_value: string
file_modify_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileModifyEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_set_events:
- process_guid: 10
registry_data: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: RegistrySetEvent
registry_data_length: 10
registry_value: string
registry_key: string
process_name: string
process_id: 10
process_username: string
file_create_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileCreateEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
registry_create_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryCreateEvent
library_load_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
type: LibraryLoadEvent
dll_library_name: string
dll_library_path: string
file_move_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileMoveEvent
old_name: string
file_path: string
process_name: string
process_id: 10
process_username: string
new_name: string
file_delete_events:
- file_name: string
process_guid: 10
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
type: FileDeleteEvent
file_path: string
process_name: string
process_id: 10
process_username: string
failed: false
netflow_events:
- parent_process_name: string
byte_count_in: 10
process_guid: 10
process_path: string
traffic:
destination_host_name: string
protocol: 10
source_ip: string
destination_subnet: string
destination_ip: string
source_subnet: string
destination_port: 10
direction: incoming
source_port: 10
flow_time: '2016-01-01T01:01:01Z'
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
parent_process_account: string
type: NetflowEvent
process_account_type: string
parent_process_path: string
parent_process_id: 10
parent_process_args: string
process_name: string
process_account: string
parent_process_account_type: string
process_hash: string
process_id: 10
parent_process_hash: string
process_username: string
byte_count_out: 10
process_args: string
registry_rename_events:
- time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
process_id: 10
process_name: string
process_guid: 10
process_username: string
registry_key: string
type: RegistryRenameEvent
registry_old_key: string
timestamp: '2016-01-01T01:01:01Z'
confidence: High
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
sensor: endpoint
data:
columns:
- name: string
type: integer
description: string
required: true
short_description: string
rows:
- - anything
row_count: 10
campaign_refs:
- string
vulnerability_refs:
- string
asset_properties_refs:
- string
relationships:
- description: string
schema_version: 1.3.30
revision: 10
target_ref: string
type: relationship
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
source_ref: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
relationship_type: attributed-to
timestamp: '2016-01-01T01:01:01Z'
verdict_refs:
- string
malware_refs:
- string
incident_refs:
- string
vulnerabilities:
- description: string
schema_version: 1.3.30
revision: 10
published_date: '2016-01-01T01:01:01Z'
cve:
cve_data_meta:
id: string
assigner: string
configurations:
CVE_data_version: string
nodes:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
children:
- operator: AND
cpe_match:
- vulnerable: true
cpe23Uri: string
versionStartIncluding: string
versionEndIncluding: string
versionStartExcluding: string
versionEndExcluding: string
negate: true
negate: true
type: vulnerability
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
tlp: green
timestamp: '2016-01-01T01:01:01Z'
last_modified_date: '2016-01-01T01:01:01Z'
impact:
cvss_v2:
integrity_impact: complete
target_distribution: not_defined
availability_requirement: not_defined
exploitability: not_defined
access_complexity: low
temporal_vector_string: string
exploitability_score: 10.0
impact_score: 10.0
user_interaction_required: true
environmental_vector_string: string
obtain_other_privilege: true
availability_impact: complete
access_vector: network
base_severity: High
confidentiality_impact: complete
confidentiality_requirement: not_defined
report_confidence: not_defined
authentication: none
base_score: 10.0
obtain_user_privilege: true
obtain_all_privilege: true
collateral_damage_potential: not_defined
remediation_level: not_defined
vector_string: string
integrity_requirement: not_defined
cvss_v3:
integrity_impact: high
modified_user_interaction: none
modified_scope: not_defined
availability_requirement: high
user_interaction: none
modified_integrity_impact: not_defined
privileges_required: high
exploitability_score: 10.0
impact_score: 10.0
environmental_severity: critical
modified_availability_impact: not_defined
availability_impact: high
scope: changed
exploit_code_maturity: functional
modified_attack_complexity: not_defined
base_severity: critical
confidentiality_impact: high
temporal_severity: critical
modified_confidentiality_impact: not_defined
confidentiality_requirement: high
report_confidence: confirmed
temporal_score: 10.0
modified_privileges_required: not_defined
modified_attack_vector: not_defined
base_score: 10.0
environmental_score: 10.0
remediation_level: high
vector_string: string
integrity_requirement: high
attack_vector: adjacent_network
attack_complexity: high
coas:
- description: string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
stage: Containment
schema_version: 1.3.30
revision: 10
efficacy: High
type: coa
related_COAs:
- confidence: High
source: string
relationship: string
COA_id: string
source: string
external_ids:
- string
short_description: string
title: string
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
coa_type: Diplomatic Actions
language: string
id: string
tlp: green
objective:
- string
cost: High
timestamp: '2016-01-01T01:01:01Z'
open_c2_coa:
type: structured_coa
id: string
action:
type: alert
target:
type: acudid
specifiers: string
actuator:
type: endpoint
specifiers:
- string
modifiers:
response: acknowledge
method:
- acl
additional_properties:
context: string
time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
frequency: string
duration: '2016-01-01T01:01:01Z'
source: string
search: cve
option: string
id: string
location: internal
delay: '2016-01-01T01:01:01Z'
destination: copy-to
structured_coa_type: openc2
impact: string
description: Describes a Bundle of any set of CTIM entities.
investigated_observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
required:
- bundle
required: true
/v2/investigation/{investigation-id}/observable/add:
post:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/transit+msgpack:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/transit+json:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/edn:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: investigation-id
description: The investigation in scope
required: true
title: InvestigationId
schema:
type: string
format: uuid
default: 61399c06-5ea8-44ae-8256-cfcf4437ca5a
tags:
- v2
summary: Add observables to an investigation
security:
- JWT-Bearer: []
- oauth2: []
requestBody:
content:
application/json:
schema:
type: object
properties:
observables:
title: ObservablesList
description: Observables that will be investigated
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
modules:
title: Modules
description: Module Ids that will be called during investigation for iroh-enrich.
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
time_window:
title: TimeWindow
description: A window of start_time to end_time to filter returned sightings.
type: object
properties:
start_time:
title: StartTime
description: Return events after this time.
type: string
format: date-time
example: '2026-08-18T22:03:32.803876481Z'
end_time:
title: EndTime
description: Will be used to filter Events that occurred before this time (defaults to now)
type: string
format: date-time
example: '2026-08-18T22:03:32.803889681Z'
required:
- start_time
required:
- observables
application/transit+msgpack:
schema:
type: object
properties:
observables:
title: ObservablesList
description: Observables that will be investigated
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
modules:
title: Modules
description: Module Ids that will be called during investigation for iroh-enrich.
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
time_window:
title: TimeWindow
description: A window of start_time to end_time to filter returned sightings.
type: object
properties:
start_time:
title: StartTime
description: Return events after this time.
type: string
format: date-time
example: '2026-08-18T22:03:32.803876481Z'
end_time:
title: EndTime
description: Will be used to filter Events that occurred before this time (defaults to now)
type: string
format: date-time
example: '2026-08-18T22:03:32.803889681Z'
required:
- start_time
required:
- observables
application/transit+json:
schema:
type: object
properties:
observables:
title: ObservablesList
description: Observables that will be investigated
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
modules:
title: Modules
description: Module Ids that will be called during investigation for iroh-enrich.
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
time_window:
title: TimeWindow
description: A window of start_time to end_time to filter returned sightings.
type: object
properties:
start_time:
title: StartTime
description: Return events after this time.
type: string
format: date-time
example: '2026-08-18T22:03:32.803876481Z'
end_time:
title: EndTime
description: Will be used to filter Events that occurred before this time (defaults to now)
type: string
format: date-time
example: '2026-08-18T22:03:32.803889681Z'
required:
- start_time
required:
- observables
application/edn:
schema:
type: object
properties:
observables:
title: ObservablesList
description: Observables that will be investigated
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
modules:
title: Modules
description: Module Ids that will be called during investigation for iroh-enrich.
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
time_window:
title: TimeWindow
description: A window of start_time to end_time to filter returned sightings.
type: object
properties:
start_time:
title: StartTime
description: Return events after this time.
type: string
format: date-time
example: '2026-08-18T22:03:32.803876481Z'
end_time:
title: EndTime
description: Will be used to filter Events that occurred before this time (defaults to now)
type: string
format: date-time
example: '2026-08-18T22:03:32.803889681Z'
required:
- start_time
required:
- observables
required: true
/v2/investigation/{investigation-id}/observable/remove:
post:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/transit+msgpack:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/transit+json:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/edn:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: investigation-id
description: The investigation in scope
required: true
title: InvestigationId
schema:
type: string
format: uuid
default: 61399c06-5ea8-44ae-8256-cfcf4437ca5a
tags:
- v2
summary: Remove observables from an investigation.
security:
- JWT-Bearer: []
- oauth2: []
requestBody:
content:
application/json:
schema:
type: object
properties:
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
required:
- observables
application/transit+msgpack:
schema:
type: object
properties:
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
required:
- observables
application/transit+json:
schema:
type: object
properties:
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
required:
- observables
application/edn:
schema:
type: object
properties:
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
required:
- observables
required: true
/v2/investigation/{investigation-id}/task:
post:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema: {}
application/transit+msgpack:
schema: {}
application/transit+json:
schema: {}
application/edn:
schema: {}
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: investigation-id
description: The investigation in scope
required: true
title: InvestigationId
schema:
type: string
format: uuid
default: 61399c06-5ea8-44ae-8256-cfcf4437ca5a
tags:
- v2
summary: Run a task
security:
- JWT-Bearer: []
- oauth2: []
requestBody:
content:
application/json:
schema: {}
application/transit+msgpack:
schema: {}
application/transit+json:
schema: {}
application/edn:
schema: {}
required: true
/v2/investigation/{investigation-id}/edit:
put:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/transit+msgpack:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/transit+json:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/edn:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: investigation-id
description: The investigation in scope
required: true
title: InvestigationId
schema:
type: string
format: uuid
default: 61399c06-5ea8-44ae-8256-cfcf4437ca5a
tags:
- v2
summary: Saves an investigation in place.
security:
- JWT-Bearer: []
- oauth2: []
requestBody:
content:
application/json:
schema:
type: object
properties:
title:
type: string
minLength: 1
maxLength: 1024
description:
type: string
minLength: 0
maxLength: 5000
required:
- title
application/transit+msgpack:
schema:
type: object
properties:
title:
type: string
minLength: 1
maxLength: 1024
description:
type: string
minLength: 0
maxLength: 5000
required:
- title
application/transit+json:
schema:
type: object
properties:
title:
type: string
minLength: 1
maxLength: 1024
description:
type: string
minLength: 0
maxLength: 5000
required:
- title
application/edn:
schema:
type: object
properties:
title:
type: string
minLength: 1
maxLength: 1024
description:
type: string
minLength: 0
maxLength: 5000
required:
- title
required: true
/v2/investigation/{investigation-id}/copy:
post:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/transit+msgpack:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/transit+json:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/edn:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: investigation-id
description: The investigation in scope
required: true
title: InvestigationId
schema:
type: string
format: uuid
default: 61399c06-5ea8-44ae-8256-cfcf4437ca5a
tags:
- v2
summary: Create a copy of an investigation.
security:
- JWT-Bearer: []
- oauth2: []
requestBody:
content:
application/json:
schema:
type: object
properties:
saved:
type: boolean
title:
type: string
minLength: 1
maxLength: 1024
description:
type: string
minLength: 0
maxLength: 5000
application/transit+msgpack:
schema:
type: object
properties:
saved:
type: boolean
title:
type: string
minLength: 1
maxLength: 1024
description:
type: string
minLength: 0
maxLength: 5000
application/transit+json:
schema:
type: object
properties:
saved:
type: boolean
title:
type: string
minLength: 1
maxLength: 1024
description:
type: string
minLength: 0
maxLength: 5000
application/edn:
schema:
type: object
properties:
saved:
type: boolean
title:
type: string
minLength: 1
maxLength: 1024
description:
type: string
minLength: 0
maxLength: 5000
required: true
/v2/investigation/{investigation-id}/delete:
delete:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
success:
type: boolean
required:
- success
application/transit+msgpack:
schema:
type: object
properties:
success:
type: boolean
required:
- success
application/transit+json:
schema:
type: object
properties:
success:
type: boolean
required:
- success
application/edn:
schema:
type: object
properties:
success:
type: boolean
required:
- success
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: investigation-id
description: The investigation in scope
required: true
title: InvestigationId
schema:
type: string
format: uuid
default: 61399c06-5ea8-44ae-8256-cfcf4437ca5a
tags:
- v2
security:
- JWT-Bearer: []
- oauth2: []
/v2/investigation/{investigation-id}/save-as:
post:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/transit+msgpack:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/transit+json:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
application/edn:
schema:
type: object
properties:
investigation_id:
type: string
format: uuid
required:
- investigation_id
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: investigation-id
description: The investigation in scope
required: true
title: InvestigationId
schema:
type: string
format: uuid
default: 61399c06-5ea8-44ae-8256-cfcf4437ca5a
tags:
- v2
summary: Saves an investigation as a new entity.
security:
- JWT-Bearer: []
- oauth2: []
requestBody:
content:
application/json:
schema:
type: object
properties:
title:
type: string
minLength: 1
maxLength: 1024
description:
type: string
minLength: 0
maxLength: 5000
required:
- title
application/transit+msgpack:
schema:
type: object
properties:
title:
type: string
minLength: 1
maxLength: 1024
description:
type: string
minLength: 0
maxLength: 5000
required:
- title
application/transit+json:
schema:
type: object
properties:
title:
type: string
minLength: 1
maxLength: 1024
description:
type: string
minLength: 0
maxLength: 5000
required:
- title
application/edn:
schema:
type: object
properties:
title:
type: string
minLength: 1
maxLength: 1024
description:
type: string
minLength: 0
maxLength: 5000
required:
- title
required: true
/v2/incident:
post:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'201':
description: ''
content:
application/json:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
application/transit+msgpack:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
application/transit+json:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
application/edn:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
tags:
- v2
summary: Create New Incident
security:
- JWT-Bearer: []
- oauth2: []
requestBody:
content:
application/json:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
required:
- confidence
- incident_time
- status
application/transit+msgpack:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
required:
- confidence
- incident_time
- status
application/transit+json:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
required:
- confidence
- incident_time
- status
application/edn:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
required:
- confidence
- incident_time
- status
required: true
/v2/incident/delete:
post:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
success?:
type: boolean
required:
- success?
application/transit+msgpack:
schema:
type: object
properties:
success?:
type: boolean
required:
- success?
application/transit+json:
schema:
type: object
properties:
success?:
type: boolean
required:
- success?
application/edn:
schema:
type: object
properties:
success?:
type: boolean
required:
- success?
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
tags:
- v2
summary: Delete Bulk Incidents
security:
- JWT-Bearer: []
- oauth2: []
requestBody:
content:
application/json:
schema:
type: object
properties:
incident_ids:
type: array
items:
type: string
required:
- incident_ids
application/transit+msgpack:
schema:
type: object
properties:
incident_ids:
type: array
items:
type: string
required:
- incident_ids
application/transit+json:
schema:
type: object
properties:
incident_ids:
type: array
items:
type: string
required:
- incident_ids
application/edn:
schema:
type: object
properties:
incident_ids:
type: array
items:
type: string
required:
- incident_ids
required: true
/v2/incident/search:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: array
items:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
application/transit+msgpack:
schema:
type: array
items:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
application/transit+json:
schema:
type: array
items:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
application/edn:
schema:
type: array
items:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: query
name: sort_by
description: 'Sort result on fields.
The following fields are supported:
id, language, revision, schema_version, source, source_uri, timestamp, title, tlp
Fields can be combined with '','' and sort order can be
specified by '':asc'' and '':desc''. For example:
- id # sort by id ascending
- id:desc # sort by id descending
- id,language:desc # sort by id ascending, then language descending'
required: false
schema:
type: string
- in: query
name: sort_order
description: ''
required: false
schema:
type: string
enum:
- asc
- desc
- description: A integer greater than 0.
name: offset
title: PositiveInteger
example: 2
required: false
in: query
schema:
type: integer
format: int64
minimum: 0
- description: A integer greater than 0.
name: limit
title: PositiveInteger
example: 2
required: false
in: query
schema:
type: integer
format: int64
minimum: 0
- in: query
name: search_after
description: ''
required: false
x-anyOf:
- type: array
items:
type: string
- type: string
allowEmptyValue: true
schema:
type: array
items:
type: string
- in: query
name: fields
description: ''
required: false
x-anyOf:
- type: array
items:
type: array
items:
type: string
enum:
- assignees
- confidence
- detection_sources
- discovery_method
- id
- incident_time.opened
- incident_time.discovered
- incident_time.reported
- incident_time.remediated
- incident_time.closed
- incident_time.rejected
- intended_effect
- language
- meta
- promotion_method
- revision
- schema_version
- source
- source_uri
- status
- timestamp
- title
- tlp
- type: string
allowEmptyValue: true
schema:
type: array
items:
type: array
items:
type: string
enum:
- assignees
- confidence
- detection_sources
- discovery_method
- id
- incident_time.opened
- incident_time.discovered
- incident_time.reported
- incident_time.remediated
- incident_time.closed
- incident_time.rejected
- intended_effect
- language
- meta
- promotion_method
- revision
- schema_version
- source
- source_uri
- status
- timestamp
- title
- tlp
- in: query
name: tlp
description: ''
required: false
schema:
type: string
enum:
- amber
- green
- red
- white
- in: query
name: from
description: ''
required: false
schema:
type: string
format: date-time
- in: query
name: to
description: ''
required: false
schema:
type: string
format: date-time
- in: query
name: language
description: ''
required: false
schema:
type: string
- in: query
name: id
description: ''
required: false
schema:
type: string
- in: query
name: search_fields
description: ''
required: false
x-anyOf:
- type: array
items:
type: string
enum:
- id
- short_description
- title
- source
- description
- type: string
allowEmptyValue: true
schema:
type: array
items:
type: string
enum:
- id
- short_description
- title
- source
- description
- in: query
name: source
description: ''
required: false
schema:
type: string
- in: query
name: query
description: ''
required: false
schema:
type: string
- in: query
name: simple_query
description: Query String with simple query format
required: false
schema:
type: string
- description: A integer greater than 0.
name: revision
title: PositiveInteger
example: 2
required: false
in: query
schema:
type: integer
format: int64
minimum: 0
- in: query
name: assignees
description: ''
required: false
schema:
type: string
- in: query
name: categories
description: ''
required: false
schema:
type: string
- in: query
name: confidence
description: ''
required: false
schema:
type: string
- in: query
name: detection_sources
description: ''
required: false
schema:
type: string
- in: query
name: discovery_method
description: ''
required: false
schema:
type: string
- in: query
name: high_impact
description: ''
required: false
schema:
type: boolean
- in: query
name: intended_effect
description: ''
required: false
schema:
type: string
- in: query
name: promotion_method
description: ''
required: false
schema:
type: string
- in: query
name: status
description: The status of the incident
required: false
title: IncidentStatusType
schema:
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
tags:
- v2
summary: Search incidents
security:
- JWT-Bearer: []
- oauth2: []
/v2/incident/search/count:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
application/transit+msgpack:
schema:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
application/transit+json:
schema:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
application/edn:
schema:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: query
name: sort_by
description: 'Sort result on fields.
The following fields are supported:
id, language, revision, schema_version, source, source_uri, timestamp, title, tlp
Fields can be combined with '','' and sort order can be
specified by '':asc'' and '':desc''. For example:
- id # sort by id ascending
- id:desc # sort by id descending
- id,language:desc # sort by id ascending, then language descending'
required: false
schema:
type: string
- in: query
name: sort_order
description: ''
required: false
schema:
type: string
enum:
- asc
- desc
- description: A integer greater than 0.
name: offset
title: PositiveInteger
example: 2
required: false
in: query
schema:
type: integer
format: int64
minimum: 0
- description: A integer greater than 0.
name: limit
title: PositiveInteger
example: 2
required: false
in: query
schema:
type: integer
format: int64
minimum: 0
- in: query
name: search_after
description: ''
required: false
x-anyOf:
- type: array
items:
type: string
- type: string
allowEmptyValue: true
schema:
type: array
items:
type: string
- in: query
name: fields
description: ''
required: false
x-anyOf:
- type: array
items:
type: array
items:
type: string
enum:
- assignees
- confidence
- detection_sources
- discovery_method
- id
- incident_time.opened
- incident_time.discovered
- incident_time.reported
- incident_time.remediated
- incident_time.closed
- incident_time.rejected
- intended_effect
- language
- meta
- promotion_method
- revision
- schema_version
- source
- source_uri
- status
- timestamp
- title
- tlp
- type: string
allowEmptyValue: true
schema:
type: array
items:
type: array
items:
type: string
enum:
- assignees
- confidence
- detection_sources
- discovery_method
- id
- incident_time.opened
- incident_time.discovered
- incident_time.reported
- incident_time.remediated
- incident_time.closed
- incident_time.rejected
- intended_effect
- language
- meta
- promotion_method
- revision
- schema_version
- source
- source_uri
- status
- timestamp
- title
- tlp
- in: query
name: tlp
description: ''
required: false
schema:
type: string
enum:
- amber
- green
- red
- white
- in: query
name: from
description: ''
required: false
schema:
type: string
format: date-time
- in: query
name: to
description: ''
required: false
schema:
type: string
format: date-time
- in: query
name: language
description: ''
required: false
schema:
type: string
- in: query
name: id
description: ''
required: false
schema:
type: string
- in: query
name: search_fields
description: ''
required: false
x-anyOf:
- type: array
items:
type: string
enum:
- id
- short_description
- title
- source
- description
- type: string
allowEmptyValue: true
schema:
type: array
items:
type: string
enum:
- id
- short_description
- title
- source
- description
- in: query
name: source
description: ''
required: false
schema:
type: string
- in: query
name: query
description: ''
required: false
schema:
type: string
- in: query
name: simple_query
description: Query String with simple query format
required: false
schema:
type: string
- description: A integer greater than 0.
name: revision
title: PositiveInteger
example: 2
required: false
in: query
schema:
type: integer
format: int64
minimum: 0
- in: query
name: assignees
description: ''
required: false
schema:
type: string
- in: query
name: categories
description: ''
required: false
schema:
type: string
- in: query
name: confidence
description: ''
required: false
schema:
type: string
- in: query
name: detection_sources
description: ''
required: false
schema:
type: string
- in: query
name: discovery_method
description: ''
required: false
schema:
type: string
- in: query
name: high_impact
description: ''
required: false
schema:
type: boolean
- in: query
name: intended_effect
description: ''
required: false
schema:
type: string
- in: query
name: promotion_method
description: ''
required: false
schema:
type: string
- in: query
name: status
description: The status of the incident
required: false
title: IncidentStatusType
schema:
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
tags:
- v2
summary: Get Count of Incidents by Search
security:
- JWT-Bearer: []
- oauth2: []
/v2/incident/{incident-id}:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
application/transit+msgpack:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
application/transit+json:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
application/edn:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
tags:
- v2
summary: Get one incident.
security:
- JWT-Bearer: []
- oauth2: []
put:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
application/transit+msgpack:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
application/transit+json:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
application/edn:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
tags:
- v2
summary: Update one incident.
security:
- JWT-Bearer: []
- oauth2: []
requestBody:
content:
application/json:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
required:
- confidence
- incident_time
- status
application/transit+msgpack:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
required:
- confidence
- incident_time
- status
application/transit+json:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
required:
- confidence
- incident_time
- status
application/edn:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
required:
- confidence
- incident_time
- status
required: true
delete:
responses:
'204':
description: ''
content:
application/json:
schema: {}
application/transit+msgpack:
schema: {}
application/transit+json:
schema: {}
application/edn:
schema: {}
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
tags:
- v2
summary: Delete one incident.
security:
- JWT-Bearer: []
- oauth2: []
patch:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
application/transit+msgpack:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
application/transit+json:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
application/edn:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
tags:
- v2
summary: Patch one incident.
security:
- JWT-Bearer: []
- oauth2: []
requestBody:
content:
application/json:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
application/transit+msgpack:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
application/transit+json:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
application/edn:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
required: true
/v2/incident/{incident-id}/actions-taken:
post:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'201':
description: ''
content:
application/json:
schema:
type: array
items:
type: string
format: uuid
application/transit+msgpack:
schema:
type: array
items:
type: string
format: uuid
application/transit+json:
schema:
type: array
items:
type: string
format: uuid
application/edn:
schema:
type: array
items:
type: string
format: uuid
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
tags:
- v2
summary: Post actions taken for an incident
security:
- JWT-Bearer: []
- oauth2: []
requestBody:
content:
application/json:
schema:
type: array
items:
title: ActionTaken
type: object
properties:
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.572913470Z'
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573033076Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- action
- completed_at
- description
- reason
- source
- source_url
- started_at
- status
- observable
description: An action reported by a data source or XDR Automation.
application/transit+msgpack:
schema:
type: array
items:
title: ActionTaken
type: object
properties:
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.572913470Z'
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573033076Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- action
- completed_at
- description
- reason
- source
- source_url
- started_at
- status
- observable
description: An action reported by a data source or XDR Automation.
application/transit+json:
schema:
type: array
items:
title: ActionTaken
type: object
properties:
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.572913470Z'
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573033076Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- action
- completed_at
- description
- reason
- source
- source_url
- started_at
- status
- observable
description: An action reported by a data source or XDR Automation.
application/edn:
schema:
type: array
items:
title: ActionTaken
type: object
properties:
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.572913470Z'
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573033076Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- action
- completed_at
- description
- reason
- source
- source_url
- started_at
- status
- observable
description: An action reported by a data source or XDR Automation.
required: true
/v2/incident/{incident-id}/link/{entity-type}/{entity-id}:
post:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'201':
description: ''
content:
application/json:
schema:
type: object
properties:
relationship_type:
type: string
authorized_groups:
type: array
items:
type: string
source_ref:
type: string
target_ref:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- relationship
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- relationship_type
- source_ref
- target_ref
- id
- groups
- schema_version
- type
application/transit+msgpack:
schema:
type: object
properties:
relationship_type:
type: string
authorized_groups:
type: array
items:
type: string
source_ref:
type: string
target_ref:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- relationship
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- relationship_type
- source_ref
- target_ref
- id
- groups
- schema_version
- type
application/transit+json:
schema:
type: object
properties:
relationship_type:
type: string
authorized_groups:
type: array
items:
type: string
source_ref:
type: string
target_ref:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- relationship
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- relationship_type
- source_ref
- target_ref
- id
- groups
- schema_version
- type
application/edn:
schema:
type: object
properties:
relationship_type:
type: string
authorized_groups:
type: array
items:
type: string
source_ref:
type: string
target_ref:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- relationship
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- relationship_type
- source_ref
- target_ref
- id
- groups
- schema_version
- type
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident to get data for
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
- in: path
name: entity-type
description: The type of entity to attach to an incident
required: true
schema:
type: string
enum:
- casebook
- incident
- investigation
- in: path
name: entity-id
description: The ID of the entity to be attached
required: true
schema:
type: string
maxLength: 1000
minLength: 10
tags:
- v2
summary: Link incident and entity (investigation | casebook | incident)
security:
- JWT-Bearer: []
- oauth2: []
delete:
responses:
'204':
description: ''
content:
application/json:
schema: {}
application/transit+msgpack:
schema: {}
application/transit+json:
schema: {}
application/edn:
schema: {}
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident to get data for
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
- in: path
name: entity-type
description: The type of entity to attach to an incident
required: true
schema:
type: string
enum:
- casebook
- incident
- investigation
- in: path
name: entity-id
description: The ID of the entity to be attached
required: true
schema:
type: string
maxLength: 1000
minLength: 10
tags:
- v2
summary: Unlink incident and entity. (investigation | casebook | incident)
security:
- JWT-Bearer: []
- oauth2: []
/v2/incident/{incident-id}/update-context:
post:
responses:
'204':
description: ''
content:
application/json:
schema: {}
application/transit+msgpack:
schema: {}
application/transit+json:
schema: {}
application/edn:
schema: {}
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
tags:
- v2
summary: Process an incident update by invalidating the cache and finding reputations as well as resolving assets.
security:
- JWT-Bearer: []
- oauth2: []
requestBody:
content:
application/json:
schema:
type: object
properties:
refresh:
default: false
type: boolean
description: Refresh all relevant incident information.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
description: Relevant reputations will be fetched, and User Resolution will be attempted for any email and user passed in.
targets:
type: array
items:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
os:
type: string
example: string
required:
- type
- observables
- observed_time
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
description: Describes the target of the sighting and contains identifying observables for the target.
description: Asset resolution will be attempted for every target in the list with a resolvable observable in it's observable list.
detection_sources:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
description: The sources for detections in an incident
example:
- Cisco XDR Analytics
- Microsoft Defender for Endpoint
tactics:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
description: The Mitre Tactics https://attack.mitre.org/ linked to the incident
example:
- TA0011
techniques:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
description: The Mitre Techniques https://attack.mitre.org/ linked to the incident
example:
- T1595
required:
- observables
- targets
application/transit+msgpack:
schema:
type: object
properties:
refresh:
default: false
type: boolean
description: Refresh all relevant incident information.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
description: Relevant reputations will be fetched, and User Resolution will be attempted for any email and user passed in.
targets:
type: array
items:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
os:
type: string
example: string
required:
- type
- observables
- observed_time
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
description: Describes the target of the sighting and contains identifying observables for the target.
description: Asset resolution will be attempted for every target in the list with a resolvable observable in it's observable list.
detection_sources:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
description: The sources for detections in an incident
example:
- Cisco XDR Analytics
- Microsoft Defender for Endpoint
tactics:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
description: The Mitre Tactics https://attack.mitre.org/ linked to the incident
example:
- TA0011
techniques:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
description: The Mitre Techniques https://attack.mitre.org/ linked to the incident
example:
- T1595
required:
- observables
- targets
application/transit+json:
schema:
type: object
properties:
refresh:
default: false
type: boolean
description: Refresh all relevant incident information.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
description: Relevant reputations will be fetched, and User Resolution will be attempted for any email and user passed in.
targets:
type: array
items:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
os:
type: string
example: string
required:
- type
- observables
- observed_time
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
description: Describes the target of the sighting and contains identifying observables for the target.
description: Asset resolution will be attempted for every target in the list with a resolvable observable in it's observable list.
detection_sources:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
description: The sources for detections in an incident
example:
- Cisco XDR Analytics
- Microsoft Defender for Endpoint
tactics:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
description: The Mitre Tactics https://attack.mitre.org/ linked to the incident
example:
- TA0011
techniques:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
description: The Mitre Techniques https://attack.mitre.org/ linked to the incident
example:
- T1595
required:
- observables
- targets
application/edn:
schema:
type: object
properties:
refresh:
default: false
type: boolean
description: Refresh all relevant incident information.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
description: Relevant reputations will be fetched, and User Resolution will be attempted for any email and user passed in.
targets:
type: array
items:
type: object
properties:
type:
type: string
example: endpoint
description: The sensor/actuator name that best fits a device.
observables:
type: array
items:
type: object
properties:
value:
type: string
example: string
description: The value of the observable.
type:
type: string
enum:
- acudid
- amp_computer_guid
- certificate_common_name
- certificate_issuer
- certificate_serial
- cisco_cm_id
- cisco_mid
- cisco_uc_id
- cortex_agent_id
- crowdstrike_id
- cvm_id
- cybereason_id
- darktrace_id
- device
- domain
- email
- email_messageid
- email_subject
- file_name
- file_path
- google_chromebook_id
- google_cloud_id
- hostname
- imei
- imsi
- intune_id
- ip
- ipv6
- jamf_management_id
- mac_address
- md5
- meraki_network_id
- meraki_node_sn
- meraki_org_id
- ms_machine_id
- mutex
- ngfw_id
- ngfw_name
- odns_identity
- odns_identity_label
- orbital_node_id
- pki_serial
- process_args
- process_hash
- process_name
- process_path
- process_uid
- process_username
- processor_id
- registry_key
- registry_name
- registry_path
- s1_agent_id
- secure_access_id
- serial_number
- service_now_id
- sha1
- sha256
- swc_device_id
- trend_micro_id
- url
- user
- user_agent
example: acudid
description: The type of observable.
required:
- value
- type
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
example:
- value: 1.2.3.4
type: ip
observed_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If the observation was made over a period of time, than this field indicates the end of that period.
required:
- start_time
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified).
os:
type: string
example: string
required:
- type
- observables
- observed_time
example:
type: endpoint
observables:
- value: 1.2.3.4
type: ip
observed_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
os: string
description: Describes the target of the sighting and contains identifying observables for the target.
description: Asset resolution will be attempted for every target in the list with a resolvable observable in it's observable list.
detection_sources:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
description: The sources for detections in an incident
example:
- Cisco XDR Analytics
- Microsoft Defender for Endpoint
tactics:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
description: The Mitre Tactics https://attack.mitre.org/ linked to the incident
example:
- TA0011
techniques:
type: array
items:
type: string
example: string
description: String with at most 1024 characters.
description: The Mitre Techniques https://attack.mitre.org/ linked to the incident
example:
- T1595
required:
- observables
- targets
required: true
/v2/incident/{incident-id}/report:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
timeline:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- timeline
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
executive:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- executive
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
events:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- events
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
incident:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- incident
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
required:
- timeline
- executive
- events
- incident
application/transit+msgpack:
schema:
type: object
properties:
timeline:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- timeline
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
executive:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- executive
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
events:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- events
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
incident:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- incident
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
required:
- timeline
- executive
- events
- incident
application/transit+json:
schema:
type: object
properties:
timeline:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- timeline
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
executive:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- executive
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
events:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- events
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
incident:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- incident
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
required:
- timeline
- executive
- events
- incident
application/edn:
schema:
type: object
properties:
timeline:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- timeline
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
executive:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- executive
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
events:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- events
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
incident:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- incident
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
required:
- timeline
- executive
- events
- incident
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: ''
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
- in: query
name: timezone
description: ''
required: false
example: Antarctica/McMurdo
schema:
type: string
tags:
- v2
summary: Incident Report
security:
- JWT-Bearer: []
- oauth2: []
/v2/incident/{incident-id}/report/{section-id}:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- timeline
- executive
- events
- incident
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
application/transit+msgpack:
schema:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- timeline
- executive
- events
- incident
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
application/transit+json:
schema:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- timeline
- executive
- events
- incident
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
application/edn:
schema:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- timeline
- executive
- events
- incident
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: ''
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
- in: path
name: section-id
description: ''
required: true
schema:
type: string
enum:
- timeline
- executive
- events
- incident
- in: query
name: timezone
description: ''
required: false
example: Antarctica/McMurdo
schema:
type: string
tags:
- v2
summary: Incident Report Section
security:
- JWT-Bearer: []
- oauth2: []
post:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- timeline
- executive
- events
- incident
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
application/transit+msgpack:
schema:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- timeline
- executive
- events
- incident
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
application/transit+json:
schema:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- timeline
- executive
- events
- incident
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
application/edn:
schema:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- timeline
- executive
- events
- incident
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: ''
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
- in: path
name: section-id
description: ''
required: true
schema:
type: string
enum:
- timeline
- executive
- events
- incident
- in: query
name: timezone
description: ''
required: false
example: Antarctica/McMurdo
schema:
type: string
tags:
- v2
summary: Update Report Section
security:
- JWT-Bearer: []
- oauth2: []
requestBody:
content:
application/json:
schema:
type: object
properties:
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
required:
- content
application/transit+msgpack:
schema:
type: object
properties:
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
required:
- content
application/transit+json:
schema:
type: object
properties:
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
required:
- content
application/edn:
schema:
type: object
properties:
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
required:
- content
required: true
/v2/incident/{incident-id}/report/{section-id}/regenerate:
post:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- timeline
- executive
- events
- incident
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
application/transit+msgpack:
schema:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- timeline
- executive
- events
- incident
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
application/transit+json:
schema:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- timeline
- executive
- events
- incident
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
application/edn:
schema:
type: object
properties:
ai_generated:
type: boolean
content:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
created_at:
type: string
format: date-time
error:
type:
- string
- 'null'
minLength: 0
maxLength: 2500
failed:
type: boolean
generating:
type: boolean
section_id:
type: string
enum:
- timeline
- executive
- events
- incident
user_id:
type: string
updated_at:
type:
- string
- 'null'
format: date-time
required:
- ai_generated
- content
- created_at
- error
- failed
- generating
- section_id
- user_id
- updated_at
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: ''
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
- in: path
name: section-id
description: ''
required: true
schema:
type: string
enum:
- timeline
- executive
- events
- incident
- in: query
name: timezone
description: ''
required: false
example: Antarctica/McMurdo
schema:
type: string
tags:
- v2
summary: Regenerate a Report Section
security:
- JWT-Bearer: []
- oauth2: []
/v2/incident/{incident-id}/summary:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
event_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
last_seen_event:
type:
- string
- 'null'
format: date-time
first_seen_event:
type:
- string
- 'null'
format: date-time
sources:
type: array
items:
type: string
indicators:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
producer:
type: string
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
internal:
type: boolean
source:
type:
- string
- 'null'
source_uri:
type:
- string
- 'null'
sources:
type: array
items:
type: string
tags:
type:
- array
- 'null'
items:
type: string
title:
type:
- string
- 'null'
value:
type: string
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- id
- producer
- description
- short_description
- internal
- source
- source_uri
- sources
- tags
- title
- value
- count
required:
- total_count
- data
observables:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- count
required:
- total_count
- data
targets:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
- count
required:
- total_count
- data
casebooks:
type: array
items:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
incident:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
linked_incidents:
type: array
items:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
investigations:
type: array
items:
type: object
properties:
id:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
description:
type:
- string
- 'null'
source:
type:
- string
- 'null'
required:
- id
- short_description
- description
- source
linked_references:
type: object
properties:
investigation_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
incident_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
indicator_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
casebook_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
total:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- investigation_count
- incident_count
- indicator_count
- casebook_count
- total
primary_investigation:
type: object
properties:
id:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
description:
type:
- string
- 'null'
source:
type:
- string
- 'null'
required:
- id
- short_description
- description
- source
mitre_data:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
id:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
value:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
phase_name:
type: string
enum:
- privilege-escalation
- exfiltration
- defense-evasion
- initial-access
- collection
- execution
- impact
- reconnaissance
- command-and-control
- lateral-movement
- resource-development
- credential-access
- discovery
- persistence
priority:
type: integer
enum:
- 6
- 12
- 7
- 3
- 10
- 4
- 13
- 1
- 11
- 9
- 2
- 8
- 8
- 5
url:
type: string
enum:
- https://attack.mitre.org/tactics/TA0004/
- https://attack.mitre.org/tactics/TA0010/
- https://attack.mitre.org/tactics/TA0005/
- https://attack.mitre.org/tactics/TA0001/
- https://attack.mitre.org/tactics/TA0009/
- https://attack.mitre.org/tactics/TA0002/
- https://attack.mitre.org/tactics/TA0040/
- https://attack.mitre.org/tactics/TA0043/
- https://attack.mitre.org/tactics/TA0011/
- https://attack.mitre.org/tactics/TA0008/
- https://attack.mitre.org/tactics/TA0042/
- https://attack.mitre.org/tactics/TA0006/
- https://attack.mitre.org/tactics/TA0007/
- https://attack.mitre.org/tactics/TA0003/
title:
type: string
enum:
- Privilege Escalation
- Exfiltration
- Defense Evasion
- Initial Access
- Collection
- Execution
- Impact
- Reconnaissance
- Command and Control
- Lateral Movement
- Resource Development
- Credential Access
- Discovery
- Persistence
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- id
- value
- phase_name
- priority
- url
- title
- count
required:
- total_count
- data
short_id:
type:
- string
- 'null'
source:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
value:
type: string
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- value
- count
required:
- total_count
- data
severity:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
value:
type: string
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- value
- count
required:
- total_count
- data
required:
- event_count
- last_seen_event
- first_seen_event
- sources
- indicators
- observables
- targets
- casebooks
- incident
- linked_incidents
- investigations
- linked_references
- primary_investigation
- mitre_data
- source
- severity
application/transit+msgpack:
schema:
type: object
properties:
event_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
last_seen_event:
type:
- string
- 'null'
format: date-time
first_seen_event:
type:
- string
- 'null'
format: date-time
sources:
type: array
items:
type: string
indicators:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
producer:
type: string
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
internal:
type: boolean
source:
type:
- string
- 'null'
source_uri:
type:
- string
- 'null'
sources:
type: array
items:
type: string
tags:
type:
- array
- 'null'
items:
type: string
title:
type:
- string
- 'null'
value:
type: string
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- id
- producer
- description
- short_description
- internal
- source
- source_uri
- sources
- tags
- title
- value
- count
required:
- total_count
- data
observables:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- count
required:
- total_count
- data
targets:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
- count
required:
- total_count
- data
casebooks:
type: array
items:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
incident:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
linked_incidents:
type: array
items:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
investigations:
type: array
items:
type: object
properties:
id:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
description:
type:
- string
- 'null'
source:
type:
- string
- 'null'
required:
- id
- short_description
- description
- source
linked_references:
type: object
properties:
investigation_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
incident_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
indicator_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
casebook_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
total:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- investigation_count
- incident_count
- indicator_count
- casebook_count
- total
primary_investigation:
type: object
properties:
id:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
description:
type:
- string
- 'null'
source:
type:
- string
- 'null'
required:
- id
- short_description
- description
- source
mitre_data:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
id:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
value:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
phase_name:
type: string
enum:
- privilege-escalation
- exfiltration
- defense-evasion
- initial-access
- collection
- execution
- impact
- reconnaissance
- command-and-control
- lateral-movement
- resource-development
- credential-access
- discovery
- persistence
priority:
type: integer
enum:
- 6
- 12
- 7
- 3
- 10
- 4
- 13
- 1
- 11
- 9
- 2
- 8
- 8
- 5
url:
type: string
enum:
- https://attack.mitre.org/tactics/TA0004/
- https://attack.mitre.org/tactics/TA0010/
- https://attack.mitre.org/tactics/TA0005/
- https://attack.mitre.org/tactics/TA0001/
- https://attack.mitre.org/tactics/TA0009/
- https://attack.mitre.org/tactics/TA0002/
- https://attack.mitre.org/tactics/TA0040/
- https://attack.mitre.org/tactics/TA0043/
- https://attack.mitre.org/tactics/TA0011/
- https://attack.mitre.org/tactics/TA0008/
- https://attack.mitre.org/tactics/TA0042/
- https://attack.mitre.org/tactics/TA0006/
- https://attack.mitre.org/tactics/TA0007/
- https://attack.mitre.org/tactics/TA0003/
title:
type: string
enum:
- Privilege Escalation
- Exfiltration
- Defense Evasion
- Initial Access
- Collection
- Execution
- Impact
- Reconnaissance
- Command and Control
- Lateral Movement
- Resource Development
- Credential Access
- Discovery
- Persistence
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- id
- value
- phase_name
- priority
- url
- title
- count
required:
- total_count
- data
short_id:
type:
- string
- 'null'
source:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
value:
type: string
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- value
- count
required:
- total_count
- data
severity:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
value:
type: string
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- value
- count
required:
- total_count
- data
required:
- event_count
- last_seen_event
- first_seen_event
- sources
- indicators
- observables
- targets
- casebooks
- incident
- linked_incidents
- investigations
- linked_references
- primary_investigation
- mitre_data
- source
- severity
application/transit+json:
schema:
type: object
properties:
event_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
last_seen_event:
type:
- string
- 'null'
format: date-time
first_seen_event:
type:
- string
- 'null'
format: date-time
sources:
type: array
items:
type: string
indicators:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
producer:
type: string
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
internal:
type: boolean
source:
type:
- string
- 'null'
source_uri:
type:
- string
- 'null'
sources:
type: array
items:
type: string
tags:
type:
- array
- 'null'
items:
type: string
title:
type:
- string
- 'null'
value:
type: string
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- id
- producer
- description
- short_description
- internal
- source
- source_uri
- sources
- tags
- title
- value
- count
required:
- total_count
- data
observables:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- count
required:
- total_count
- data
targets:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
- count
required:
- total_count
- data
casebooks:
type: array
items:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
incident:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
linked_incidents:
type: array
items:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
investigations:
type: array
items:
type: object
properties:
id:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
description:
type:
- string
- 'null'
source:
type:
- string
- 'null'
required:
- id
- short_description
- description
- source
linked_references:
type: object
properties:
investigation_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
incident_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
indicator_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
casebook_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
total:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- investigation_count
- incident_count
- indicator_count
- casebook_count
- total
primary_investigation:
type: object
properties:
id:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
description:
type:
- string
- 'null'
source:
type:
- string
- 'null'
required:
- id
- short_description
- description
- source
mitre_data:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
id:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
value:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
phase_name:
type: string
enum:
- privilege-escalation
- exfiltration
- defense-evasion
- initial-access
- collection
- execution
- impact
- reconnaissance
- command-and-control
- lateral-movement
- resource-development
- credential-access
- discovery
- persistence
priority:
type: integer
enum:
- 6
- 12
- 7
- 3
- 10
- 4
- 13
- 1
- 11
- 9
- 2
- 8
- 8
- 5
url:
type: string
enum:
- https://attack.mitre.org/tactics/TA0004/
- https://attack.mitre.org/tactics/TA0010/
- https://attack.mitre.org/tactics/TA0005/
- https://attack.mitre.org/tactics/TA0001/
- https://attack.mitre.org/tactics/TA0009/
- https://attack.mitre.org/tactics/TA0002/
- https://attack.mitre.org/tactics/TA0040/
- https://attack.mitre.org/tactics/TA0043/
- https://attack.mitre.org/tactics/TA0011/
- https://attack.mitre.org/tactics/TA0008/
- https://attack.mitre.org/tactics/TA0042/
- https://attack.mitre.org/tactics/TA0006/
- https://attack.mitre.org/tactics/TA0007/
- https://attack.mitre.org/tactics/TA0003/
title:
type: string
enum:
- Privilege Escalation
- Exfiltration
- Defense Evasion
- Initial Access
- Collection
- Execution
- Impact
- Reconnaissance
- Command and Control
- Lateral Movement
- Resource Development
- Credential Access
- Discovery
- Persistence
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- id
- value
- phase_name
- priority
- url
- title
- count
required:
- total_count
- data
short_id:
type:
- string
- 'null'
source:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
value:
type: string
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- value
- count
required:
- total_count
- data
severity:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
value:
type: string
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- value
- count
required:
- total_count
- data
required:
- event_count
- last_seen_event
- first_seen_event
- sources
- indicators
- observables
- targets
- casebooks
- incident
- linked_incidents
- investigations
- linked_references
- primary_investigation
- mitre_data
- source
- severity
application/edn:
schema:
type: object
properties:
event_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
last_seen_event:
type:
- string
- 'null'
format: date-time
first_seen_event:
type:
- string
- 'null'
format: date-time
sources:
type: array
items:
type: string
indicators:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
producer:
type: string
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
internal:
type: boolean
source:
type:
- string
- 'null'
source_uri:
type:
- string
- 'null'
sources:
type: array
items:
type: string
tags:
type:
- array
- 'null'
items:
type: string
title:
type:
- string
- 'null'
value:
type: string
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- id
- producer
- description
- short_description
- internal
- source
- source_uri
- sources
- tags
- title
- value
- count
required:
- total_count
- data
observables:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- count
required:
- total_count
- data
targets:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
- count
required:
- total_count
- data
casebooks:
type: array
items:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
incident:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
linked_incidents:
type: array
items:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
investigations:
type: array
items:
type: object
properties:
id:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
description:
type:
- string
- 'null'
source:
type:
- string
- 'null'
required:
- id
- short_description
- description
- source
linked_references:
type: object
properties:
investigation_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
incident_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
indicator_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
casebook_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
total:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- investigation_count
- incident_count
- indicator_count
- casebook_count
- total
primary_investigation:
type: object
properties:
id:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
description:
type:
- string
- 'null'
source:
type:
- string
- 'null'
required:
- id
- short_description
- description
- source
mitre_data:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
id:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
value:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
phase_name:
type: string
enum:
- privilege-escalation
- exfiltration
- defense-evasion
- initial-access
- collection
- execution
- impact
- reconnaissance
- command-and-control
- lateral-movement
- resource-development
- credential-access
- discovery
- persistence
priority:
type: integer
enum:
- 6
- 12
- 7
- 3
- 10
- 4
- 13
- 1
- 11
- 9
- 2
- 8
- 8
- 5
url:
type: string
enum:
- https://attack.mitre.org/tactics/TA0004/
- https://attack.mitre.org/tactics/TA0010/
- https://attack.mitre.org/tactics/TA0005/
- https://attack.mitre.org/tactics/TA0001/
- https://attack.mitre.org/tactics/TA0009/
- https://attack.mitre.org/tactics/TA0002/
- https://attack.mitre.org/tactics/TA0040/
- https://attack.mitre.org/tactics/TA0043/
- https://attack.mitre.org/tactics/TA0011/
- https://attack.mitre.org/tactics/TA0008/
- https://attack.mitre.org/tactics/TA0042/
- https://attack.mitre.org/tactics/TA0006/
- https://attack.mitre.org/tactics/TA0007/
- https://attack.mitre.org/tactics/TA0003/
title:
type: string
enum:
- Privilege Escalation
- Exfiltration
- Defense Evasion
- Initial Access
- Collection
- Execution
- Impact
- Reconnaissance
- Command and Control
- Lateral Movement
- Resource Development
- Credential Access
- Discovery
- Persistence
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- id
- value
- phase_name
- priority
- url
- title
- count
required:
- total_count
- data
short_id:
type:
- string
- 'null'
source:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
value:
type: string
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- value
- count
required:
- total_count
- data
severity:
type: object
properties:
total_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
data:
type: array
items:
type: object
properties:
value:
type: string
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- value
- count
required:
- total_count
- data
required:
- event_count
- last_seen_event
- first_seen_event
- sources
- indicators
- observables
- targets
- casebooks
- incident
- linked_incidents
- investigations
- linked_references
- primary_investigation
- mitre_data
- source
- severity
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
tags:
- v2
summary: Full Incident Summary. Equivalent Data to v1 summary endpoints.
security:
- JWT-Bearer: []
- oauth2: []
/v2/incident/{incident-id}/mitre:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: array
items:
title: Mitre tactics
type: object
properties:
id:
title: MitreID
type: string
example: TA0003
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: TA0003
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Persistence
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: Persistence
description:
title: MitreDescription
type: string
example: 'The adversary is trying to maintain their foothold.
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.'
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 44
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/TA0003
description: The source url for this tactic or technique
techniques:
type: array
items:
title: Mitre techniques
type: object
properties:
id:
title: MitreID
type: string
example: T1078
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: T1078
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Account Manipulation
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: No short-description provided for MITRE Attack Pattern "Account Manipulation".
description:
title: MitreDescription
type: string
example: "Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. \n\nIn order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078)."
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 68
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/T1078
description: The source url for this tactic or technique
subtechniques:
type: array
items:
title: Mitre Sub-techniques
type: object
properties:
id:
title: MitreID
type: string
example: T1078.100
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: T1078.100
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Additional Cloud Credentials
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: No short-description provided for MITRE Attack Pattern "Additional Cloud Credentials".
description:
title: MitreDescription
type: string
example: "Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.\n\nFor example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure / Entra ID.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)\n\nIn infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)\n\nAdversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. Alternatively, they may use the CreateLoginProfile API in AWS to add a password that can be used to log into the AWS Management Console for [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538).(Citation: Permiso Scattered Spider 2023)(Citation: Lacework AI Resource Hijacking 2024) If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) \n\nIn AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated.\n(Citation: Crowdstrike AWS User Federation Persistence)\n\nIn Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42 Operations 2024) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user’s primary password is reset.(Citation: Microsoft Entra ID App Passwords)"
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 67
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/T1078/100
description: The source url for this tactic or technique
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
description: A MITRE object from https://attack.mitre.org/
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- subtechniques
description: A MITRE object from https://attack.mitre.org/
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- techniques
description: A MITRE object from https://attack.mitre.org/
application/transit+msgpack:
schema:
type: array
items:
title: Mitre tactics
type: object
properties:
id:
title: MitreID
type: string
example: TA0003
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: TA0003
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Persistence
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: Persistence
description:
title: MitreDescription
type: string
example: 'The adversary is trying to maintain their foothold.
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.'
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 44
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/TA0003
description: The source url for this tactic or technique
techniques:
type: array
items:
title: Mitre techniques
type: object
properties:
id:
title: MitreID
type: string
example: T1078
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: T1078
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Account Manipulation
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: No short-description provided for MITRE Attack Pattern "Account Manipulation".
description:
title: MitreDescription
type: string
example: "Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. \n\nIn order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078)."
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 68
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/T1078
description: The source url for this tactic or technique
subtechniques:
type: array
items:
title: Mitre Sub-techniques
type: object
properties:
id:
title: MitreID
type: string
example: T1078.100
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: T1078.100
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Additional Cloud Credentials
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: No short-description provided for MITRE Attack Pattern "Additional Cloud Credentials".
description:
title: MitreDescription
type: string
example: "Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.\n\nFor example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure / Entra ID.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)\n\nIn infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)\n\nAdversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. Alternatively, they may use the CreateLoginProfile API in AWS to add a password that can be used to log into the AWS Management Console for [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538).(Citation: Permiso Scattered Spider 2023)(Citation: Lacework AI Resource Hijacking 2024) If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) \n\nIn AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated.\n(Citation: Crowdstrike AWS User Federation Persistence)\n\nIn Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42 Operations 2024) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user’s primary password is reset.(Citation: Microsoft Entra ID App Passwords)"
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 67
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/T1078/100
description: The source url for this tactic or technique
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
description: A MITRE object from https://attack.mitre.org/
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- subtechniques
description: A MITRE object from https://attack.mitre.org/
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- techniques
description: A MITRE object from https://attack.mitre.org/
application/transit+json:
schema:
type: array
items:
title: Mitre tactics
type: object
properties:
id:
title: MitreID
type: string
example: TA0003
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: TA0003
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Persistence
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: Persistence
description:
title: MitreDescription
type: string
example: 'The adversary is trying to maintain their foothold.
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.'
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 44
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/TA0003
description: The source url for this tactic or technique
techniques:
type: array
items:
title: Mitre techniques
type: object
properties:
id:
title: MitreID
type: string
example: T1078
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: T1078
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Account Manipulation
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: No short-description provided for MITRE Attack Pattern "Account Manipulation".
description:
title: MitreDescription
type: string
example: "Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. \n\nIn order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078)."
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 68
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/T1078
description: The source url for this tactic or technique
subtechniques:
type: array
items:
title: Mitre Sub-techniques
type: object
properties:
id:
title: MitreID
type: string
example: T1078.100
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: T1078.100
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Additional Cloud Credentials
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: No short-description provided for MITRE Attack Pattern "Additional Cloud Credentials".
description:
title: MitreDescription
type: string
example: "Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.\n\nFor example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure / Entra ID.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)\n\nIn infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)\n\nAdversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. Alternatively, they may use the CreateLoginProfile API in AWS to add a password that can be used to log into the AWS Management Console for [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538).(Citation: Permiso Scattered Spider 2023)(Citation: Lacework AI Resource Hijacking 2024) If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) \n\nIn AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated.\n(Citation: Crowdstrike AWS User Federation Persistence)\n\nIn Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42 Operations 2024) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user’s primary password is reset.(Citation: Microsoft Entra ID App Passwords)"
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 67
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/T1078/100
description: The source url for this tactic or technique
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
description: A MITRE object from https://attack.mitre.org/
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- subtechniques
description: A MITRE object from https://attack.mitre.org/
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- techniques
description: A MITRE object from https://attack.mitre.org/
application/edn:
schema:
type: array
items:
title: Mitre tactics
type: object
properties:
id:
title: MitreID
type: string
example: TA0003
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: TA0003
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Persistence
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: Persistence
description:
title: MitreDescription
type: string
example: 'The adversary is trying to maintain their foothold.
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.'
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 44
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/TA0003
description: The source url for this tactic or technique
techniques:
type: array
items:
title: Mitre techniques
type: object
properties:
id:
title: MitreID
type: string
example: T1078
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: T1078
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Account Manipulation
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: No short-description provided for MITRE Attack Pattern "Account Manipulation".
description:
title: MitreDescription
type: string
example: "Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. \n\nIn order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078)."
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 68
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/T1078
description: The source url for this tactic or technique
subtechniques:
type: array
items:
title: Mitre Sub-techniques
type: object
properties:
id:
title: MitreID
type: string
example: T1078.100
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: T1078.100
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Additional Cloud Credentials
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: No short-description provided for MITRE Attack Pattern "Additional Cloud Credentials".
description:
title: MitreDescription
type: string
example: "Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.\n\nFor example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure / Entra ID.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)\n\nIn infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)\n\nAdversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. Alternatively, they may use the CreateLoginProfile