openapi: 3.2.0 info: title: Conure V3 API version: conure-218-1-ee422dee license: name: All Rights Reserved url: https://www.cisco.com contact: name: Cisco Security Business Group -- Advanced Threat email: cisco-intel-api-support@cisco.com description: XDR High Priority Incident and Investigation API x-provenance: method: harvested authored_by: Cisco XDR harvested_by: API Evangelist harvested_on: '2026-08-19' first_party: true provider_published: true source_host: visibility.amp.cisco.com note: Anonymously fetchable Swagger 2.0 for nine IROH services plus the CTIA threat-intelligence API. The host returns real 404s on invented paths, so the 200s are genuine. x-evidence: - type: source url: https://visibility.amp.cisco.com/iroh/iroh-int/swagger.json - type: source url: https://private.intel.amp.cisco.com/swagger.json tags: - name: v3 paths: /v3/incident/filters: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: object properties: detection_sources: type: array items: type: string tactics: type: array items: type: string techniques: type: array items: type: string application/transit+msgpack: schema: type: object properties: detection_sources: type: array items: type: string tactics: type: array items: type: string techniques: type: array items: type: string application/transit+json: schema: type: object properties: detection_sources: type: array items: type: string tactics: type: array items: type: string techniques: type: array items: type: string application/edn: schema: type: object properties: detection_sources: type: array items: type: string tactics: type: array items: type: string techniques: type: array items: type: string '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message tags: - v3 summary: incident search filter values security: - JWT-Bearer: [] - oauth2: [] /v3/incident/search: post: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: array items: type: object properties: assignees: type: array items: type: string categories: type: array items: type: string enum: - Attrition - Denial of Service - Exercise - Exercise/Network Defense Testing - Explained Anomaly - Forensics - Improper Usage - Intelligence - Investigating - Investigation - Malicious Code - Malicious Logic - Non-Compliant - Reconnaissance - Root Level - Scans/Probes/Attempted Access - Unauthorized Access - Unsuccessful - User Level - eDiscovery confidence: type: string enum: - High - Info - Low - Medium - None - Unknown detection_sources: type: array items: type: string detection_status: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates discovery_method: type: string enum: - SecureX Threat Hunting - Agent Disclosure - Antivirus - Audit - Customer - External - Fraud Detection - Financial Audit - HIPS - IT Audit - Incident Response - Internal - Fraud Detection - Law Enforcement - Log Review - Monitoring Service - NIDS - Security Alarm - Unknown - Unrelated Party - User incident_time: type: object properties: opened: type: string closed: type: string discovered: type: string rejected: type: string remediated: type: string reported: type: string required: - opened intended_effect: type: string enum: - Account Takeover - Advantage - Advantage - Economic - Advantage - Military - Advantage - Political - Brand Damage - Competitive Advantage - Degradation of Service - Denial and Deception - Destruction - Disruption - Embarrassment - Exposure - Extortion - Fraud - Harassment - ICS Control - Theft - Theft - Credential Theft - Theft - Identity Theft - Theft - Intellectual Property - Theft - Theft of Proprietary Information - Traffic Diversion - Unauthorized Access last_activity: type: - string - 'null' x-anyOf: - type: string - type: string format: date-time meta: type: object properties: ai_description: type: boolean helios_report_generated: type: boolean promotion_method: type: string enum: - Automated - Manual scores: type: object properties: asset: type: integer format: int64 minimum: 0 maximum: 10 global: type: integer format: int64 minimum: 0 maximum: 1000 ml_score: type: number format: double ttp: type: integer format: int64 minimum: 0 maximum: 100 severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_id: type: - string - 'null' status: title: IncidentStatusType type: string enum: - New - Closed - 'Open: Recovered' - 'Closed: Other' - 'Hold: Internal' - 'Hold: Legal' - 'Closed: Under Review' - Rejected - Open - 'Closed: Merged' - Restoration Achieved - Incident Reported - 'Closed: Suspected' - Stalled - 'Open: Contained' - 'Closed: Near-Miss' - 'Hold: External' - Containment Achieved - 'New: Processing' - 'Closed: Confirmed Threat' - 'Closed: False Positive' - 'Open: Reported' - 'Open: Investigating' - Hold - 'New: Presented' description: The status of the incident tactics: type: array items: type: string techniques: type: array items: type: string id: type: string description: type: string short_description: type: string source: type: string source_uri: type: string title: type: string language: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name external_ids: type: array items: type: string tlp: type: string enum: - amber - green - red - white application/transit+msgpack: schema: type: array items: type: object properties: assignees: type: array items: type: string categories: type: array items: type: string enum: - Attrition - Denial of Service - Exercise - Exercise/Network Defense Testing - Explained Anomaly - Forensics - Improper Usage - Intelligence - Investigating - Investigation - Malicious Code - Malicious Logic - Non-Compliant - Reconnaissance - Root Level - Scans/Probes/Attempted Access - Unauthorized Access - Unsuccessful - User Level - eDiscovery confidence: type: string enum: - High - Info - Low - Medium - None - Unknown detection_sources: type: array items: type: string detection_status: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates discovery_method: type: string enum: - SecureX Threat Hunting - Agent Disclosure - Antivirus - Audit - Customer - External - Fraud Detection - Financial Audit - HIPS - IT Audit - Incident Response - Internal - Fraud Detection - Law Enforcement - Log Review - Monitoring Service - NIDS - Security Alarm - Unknown - Unrelated Party - User incident_time: type: object properties: opened: type: string closed: type: string discovered: type: string rejected: type: string remediated: type: string reported: type: string required: - opened intended_effect: type: string enum: - Account Takeover - Advantage - Advantage - Economic - Advantage - Military - Advantage - Political - Brand Damage - Competitive Advantage - Degradation of Service - Denial and Deception - Destruction - Disruption - Embarrassment - Exposure - Extortion - Fraud - Harassment - ICS Control - Theft - Theft - Credential Theft - Theft - Identity Theft - Theft - Intellectual Property - Theft - Theft of Proprietary Information - Traffic Diversion - Unauthorized Access last_activity: type: - string - 'null' x-anyOf: - type: string - type: string format: date-time meta: type: object properties: ai_description: type: boolean helios_report_generated: type: boolean promotion_method: type: string enum: - Automated - Manual scores: type: object properties: asset: type: integer format: int64 minimum: 0 maximum: 10 global: type: integer format: int64 minimum: 0 maximum: 1000 ml_score: type: number format: double ttp: type: integer format: int64 minimum: 0 maximum: 100 severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_id: type: - string - 'null' status: title: IncidentStatusType type: string enum: - New - Closed - 'Open: Recovered' - 'Closed: Other' - 'Hold: Internal' - 'Hold: Legal' - 'Closed: Under Review' - Rejected - Open - 'Closed: Merged' - Restoration Achieved - Incident Reported - 'Closed: Suspected' - Stalled - 'Open: Contained' - 'Closed: Near-Miss' - 'Hold: External' - Containment Achieved - 'New: Processing' - 'Closed: Confirmed Threat' - 'Closed: False Positive' - 'Open: Reported' - 'Open: Investigating' - Hold - 'New: Presented' description: The status of the incident tactics: type: array items: type: string techniques: type: array items: type: string id: type: string description: type: string short_description: type: string source: type: string source_uri: type: string title: type: string language: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name external_ids: type: array items: type: string tlp: type: string enum: - amber - green - red - white application/transit+json: schema: type: array items: type: object properties: assignees: type: array items: type: string categories: type: array items: type: string enum: - Attrition - Denial of Service - Exercise - Exercise/Network Defense Testing - Explained Anomaly - Forensics - Improper Usage - Intelligence - Investigating - Investigation - Malicious Code - Malicious Logic - Non-Compliant - Reconnaissance - Root Level - Scans/Probes/Attempted Access - Unauthorized Access - Unsuccessful - User Level - eDiscovery confidence: type: string enum: - High - Info - Low - Medium - None - Unknown detection_sources: type: array items: type: string detection_status: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates discovery_method: type: string enum: - SecureX Threat Hunting - Agent Disclosure - Antivirus - Audit - Customer - External - Fraud Detection - Financial Audit - HIPS - IT Audit - Incident Response - Internal - Fraud Detection - Law Enforcement - Log Review - Monitoring Service - NIDS - Security Alarm - Unknown - Unrelated Party - User incident_time: type: object properties: opened: type: string closed: type: string discovered: type: string rejected: type: string remediated: type: string reported: type: string required: - opened intended_effect: type: string enum: - Account Takeover - Advantage - Advantage - Economic - Advantage - Military - Advantage - Political - Brand Damage - Competitive Advantage - Degradation of Service - Denial and Deception - Destruction - Disruption - Embarrassment - Exposure - Extortion - Fraud - Harassment - ICS Control - Theft - Theft - Credential Theft - Theft - Identity Theft - Theft - Intellectual Property - Theft - Theft of Proprietary Information - Traffic Diversion - Unauthorized Access last_activity: type: - string - 'null' x-anyOf: - type: string - type: string format: date-time meta: type: object properties: ai_description: type: boolean helios_report_generated: type: boolean promotion_method: type: string enum: - Automated - Manual scores: type: object properties: asset: type: integer format: int64 minimum: 0 maximum: 10 global: type: integer format: int64 minimum: 0 maximum: 1000 ml_score: type: number format: double ttp: type: integer format: int64 minimum: 0 maximum: 100 severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_id: type: - string - 'null' status: title: IncidentStatusType type: string enum: - New - Closed - 'Open: Recovered' - 'Closed: Other' - 'Hold: Internal' - 'Hold: Legal' - 'Closed: Under Review' - Rejected - Open - 'Closed: Merged' - Restoration Achieved - Incident Reported - 'Closed: Suspected' - Stalled - 'Open: Contained' - 'Closed: Near-Miss' - 'Hold: External' - Containment Achieved - 'New: Processing' - 'Closed: Confirmed Threat' - 'Closed: False Positive' - 'Open: Reported' - 'Open: Investigating' - Hold - 'New: Presented' description: The status of the incident tactics: type: array items: type: string techniques: type: array items: type: string id: type: string description: type: string short_description: type: string source: type: string source_uri: type: string title: type: string language: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name external_ids: type: array items: type: string tlp: type: string enum: - amber - green - red - white application/edn: schema: type: array items: type: object properties: assignees: type: array items: type: string categories: type: array items: type: string enum: - Attrition - Denial of Service - Exercise - Exercise/Network Defense Testing - Explained Anomaly - Forensics - Improper Usage - Intelligence - Investigating - Investigation - Malicious Code - Malicious Logic - Non-Compliant - Reconnaissance - Root Level - Scans/Probes/Attempted Access - Unauthorized Access - Unsuccessful - User Level - eDiscovery confidence: type: string enum: - High - Info - Low - Medium - None - Unknown detection_sources: type: array items: type: string detection_status: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates discovery_method: type: string enum: - SecureX Threat Hunting - Agent Disclosure - Antivirus - Audit - Customer - External - Fraud Detection - Financial Audit - HIPS - IT Audit - Incident Response - Internal - Fraud Detection - Law Enforcement - Log Review - Monitoring Service - NIDS - Security Alarm - Unknown - Unrelated Party - User incident_time: type: object properties: opened: type: string closed: type: string discovered: type: string rejected: type: string remediated: type: string reported: type: string required: - opened intended_effect: type: string enum: - Account Takeover - Advantage - Advantage - Economic - Advantage - Military - Advantage - Political - Brand Damage - Competitive Advantage - Degradation of Service - Denial and Deception - Destruction - Disruption - Embarrassment - Exposure - Extortion - Fraud - Harassment - ICS Control - Theft - Theft - Credential Theft - Theft - Identity Theft - Theft - Intellectual Property - Theft - Theft of Proprietary Information - Traffic Diversion - Unauthorized Access last_activity: type: - string - 'null' x-anyOf: - type: string - type: string format: date-time meta: type: object properties: ai_description: type: boolean helios_report_generated: type: boolean promotion_method: type: string enum: - Automated - Manual scores: type: object properties: asset: type: integer format: int64 minimum: 0 maximum: 10 global: type: integer format: int64 minimum: 0 maximum: 1000 ml_score: type: number format: double ttp: type: integer format: int64 minimum: 0 maximum: 100 severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_id: type: - string - 'null' status: title: IncidentStatusType type: string enum: - New - Closed - 'Open: Recovered' - 'Closed: Other' - 'Hold: Internal' - 'Hold: Legal' - 'Closed: Under Review' - Rejected - Open - 'Closed: Merged' - Restoration Achieved - Incident Reported - 'Closed: Suspected' - Stalled - 'Open: Contained' - 'Closed: Near-Miss' - 'Hold: External' - Containment Achieved - 'New: Processing' - 'Closed: Confirmed Threat' - 'Closed: False Positive' - 'Open: Reported' - 'Open: Investigating' - Hold - 'New: Presented' description: The status of the incident tactics: type: array items: type: string techniques: type: array items: type: string id: type: string description: type: string short_description: type: string source: type: string source_uri: type: string title: type: string language: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name external_ids: type: array items: type: string tlp: type: string enum: - amber - green - red - white '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message tags: - v3 summary: Search incidents security: - JWT-Bearer: [] - oauth2: [] requestBody: content: application/json: schema: type: object properties: limit: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 offset: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 sort_by: type: array items: type: object properties: field: type: string enum: - title - scores - status - created_at - updated_at - last_activity - short_id direction: type: string enum: - asc - desc required: - field - direction filters: type: object properties: id: type: object properties: include: type: array items: type: string exclude: type: array items: type: string description: The incident ids to include or explicitly exclude from the search. example: '{"include":["7889a175-f43c-42ad-baac-ff55497c1730","incident-7889a175-f43c-42ad-baac-ff55497c1730","https://private.intel.int.iroh.site:443/ctia/incident/incident-7889a175-f43c-42ad-baac-ff55497c1730"],"exclude":["b2f76042-74f2-4697-a474-7dcdc04145f5","incident-b2f76042-74f2-4697-a474-7dcdc04145f5","https://private.intel.int.iroh.site:443/ctia/incident/incident-b2f76042-74f2-4697-a474-7dcdc04145f5"]}' status: type: object properties: include: type: array items: type: string exclude: type: array items: type: string description: The incident statuses to include or explicitly exclude from the search. example: '{"include":["New: Waiting"],"exclude":["New: Processing"]}' detection_status: type: object properties: include: type: array items: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates exclude: type: array items: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates description: The incident lifecycle (detection_status) values to include or explicitly exclude from the search. example: '{"include":["active"],"exclude":["inactive_oversized"]}' score: type: object properties: min: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 max: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 description: The minimum and/or maximum global score (inclusive). example: '{"min":10,"max":1000}' assignees: type: object properties: include: type: array items: type: string exclude: type: array items: type: string exists: type: boolean detection_sources: type: object properties: include: type: array items: type: string exclude: type: array items: type: string tactics: type: object properties: include: type: array items: type: string exclude: type: array items: type: string description: Mitre Tactic ids to include or explicitly exclude from the search. Wildcards like 'TA01*' are allowed. example: '{"include":["TA0011"],"exclude":["TA01*"]}' techniques: type: object properties: include: type: array items: type: string exclude: type: array items: type: string description: Mitre Technique or sub-Technique ids to include or explicitly exclude from the search. Wildcards like 'T01*' are allowed. example: '{"include":["T0011"],"exclude":["T01*"]}' short_id: type: string description: Exact match filter for incident short_id. Accepts with or without INC- prefix. example: INC-123 created_at: type: object properties: start_date: type: string end_date: type: string description: The search range (inclusive; bounded or unbounded) of the date(s) at which incidents first arrive in conure example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' last_activity: type: object properties: start_date: type: string end_date: type: string description: The search range (inclusive; bounded or unbounded) of the date(s) at which an incident was either linked to another incident or received a new sighting. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' updated_at: type: object properties: start_date: type: string end_date: type: string description: The search range (inclusive; bounded or unbounded) of the date(s) at which incidents were last updated in conure example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' opened: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were opened. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' closed: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were closed. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' discovered: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were discovered. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' reported: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were reported. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' remediated: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were remediated. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' rejected: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were rejected. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' fields: type: array items: type: string enum: - assignees - categories - confidence - created_at - description - detection_sources - detection_status - discovery_method - external_ids - external_references - id - incident_time - intended_effect - language - last_activity - meta - owner - promotion_method - revision - schema_version - scores - severity - short_description - short_id - source - source_uri - status - tactics - techniques - title - tlp - type - updated_at description: The list of fields to return for each incident in the search results example: '["id","status","scores","description","updated_at"]' search_text: type: string description: A simple string that is searched across 'id', 'title', 'description', 'short_description', 'source', and exact short_id matches example: malicious process detected application/transit+msgpack: schema: type: object properties: limit: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 offset: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 sort_by: type: array items: type: object properties: field: type: string enum: - title - scores - status - created_at - updated_at - last_activity - short_id direction: type: string enum: - asc - desc required: - field - direction filters: type: object properties: id: type: object properties: include: type: array items: type: string exclude: type: array items: type: string description: The incident ids to include or explicitly exclude from the search. example: '{"include":["7889a175-f43c-42ad-baac-ff55497c1730","incident-7889a175-f43c-42ad-baac-ff55497c1730","https://private.intel.int.iroh.site:443/ctia/incident/incident-7889a175-f43c-42ad-baac-ff55497c1730"],"exclude":["b2f76042-74f2-4697-a474-7dcdc04145f5","incident-b2f76042-74f2-4697-a474-7dcdc04145f5","https://private.intel.int.iroh.site:443/ctia/incident/incident-b2f76042-74f2-4697-a474-7dcdc04145f5"]}' status: type: object properties: include: type: array items: type: string exclude: type: array items: type: string description: The incident statuses to include or explicitly exclude from the search. example: '{"include":["New: Waiting"],"exclude":["New: Processing"]}' detection_status: type: object properties: include: type: array items: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates exclude: type: array items: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates description: The incident lifecycle (detection_status) values to include or explicitly exclude from the search. example: '{"include":["active"],"exclude":["inactive_oversized"]}' score: type: object properties: min: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 max: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 description: The minimum and/or maximum global score (inclusive). example: '{"min":10,"max":1000}' assignees: type: object properties: include: type: array items: type: string exclude: type: array items: type: string exists: type: boolean detection_sources: type: object properties: include: type: array items: type: string exclude: type: array items: type: string tactics: type: object properties: include: type: array items: type: string exclude: type: array items: type: string description: Mitre Tactic ids to include or explicitly exclude from the search. Wildcards like 'TA01*' are allowed. example: '{"include":["TA0011"],"exclude":["TA01*"]}' techniques: type: object properties: include: type: array items: type: string exclude: type: array items: type: string description: Mitre Technique or sub-Technique ids to include or explicitly exclude from the search. Wildcards like 'T01*' are allowed. example: '{"include":["T0011"],"exclude":["T01*"]}' short_id: type: string description: Exact match filter for incident short_id. Accepts with or without INC- prefix. example: INC-123 created_at: type: object properties: start_date: type: string end_date: type: string description: The search range (inclusive; bounded or unbounded) of the date(s) at which incidents first arrive in conure example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' last_activity: type: object properties: start_date: type: string end_date: type: string description: The search range (inclusive; bounded or unbounded) of the date(s) at which an incident was either linked to another incident or received a new sighting. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' updated_at: type: object properties: start_date: type: string end_date: type: string description: The search range (inclusive; bounded or unbounded) of the date(s) at which incidents were last updated in conure example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' opened: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were opened. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' closed: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were closed. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' discovered: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were discovered. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' reported: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were reported. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' remediated: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were remediated. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' rejected: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were rejected. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' fields: type: array items: type: string enum: - assignees - categories - confidence - created_at - description - detection_sources - detection_status - discovery_method - external_ids - external_references - id - incident_time - intended_effect - language - last_activity - meta - owner - promotion_method - revision - schema_version - scores - severity - short_description - short_id - source - source_uri - status - tactics - techniques - title - tlp - type - updated_at description: The list of fields to return for each incident in the search results example: '["id","status","scores","description","updated_at"]' search_text: type: string description: A simple string that is searched across 'id', 'title', 'description', 'short_description', 'source', and exact short_id matches example: malicious process detected application/transit+json: schema: type: object properties: limit: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 offset: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 sort_by: type: array items: type: object properties: field: type: string enum: - title - scores - status - created_at - updated_at - last_activity - short_id direction: type: string enum: - asc - desc required: - field - direction filters: type: object properties: id: type: object properties: include: type: array items: type: string exclude: type: array items: type: string description: The incident ids to include or explicitly exclude from the search. example: '{"include":["7889a175-f43c-42ad-baac-ff55497c1730","incident-7889a175-f43c-42ad-baac-ff55497c1730","https://private.intel.int.iroh.site:443/ctia/incident/incident-7889a175-f43c-42ad-baac-ff55497c1730"],"exclude":["b2f76042-74f2-4697-a474-7dcdc04145f5","incident-b2f76042-74f2-4697-a474-7dcdc04145f5","https://private.intel.int.iroh.site:443/ctia/incident/incident-b2f76042-74f2-4697-a474-7dcdc04145f5"]}' status: type: object properties: include: type: array items: type: string exclude: type: array items: type: string description: The incident statuses to include or explicitly exclude from the search. example: '{"include":["New: Waiting"],"exclude":["New: Processing"]}' detection_status: type: object properties: include: type: array items: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates exclude: type: array items: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates description: The incident lifecycle (detection_status) values to include or explicitly exclude from the search. example: '{"include":["active"],"exclude":["inactive_oversized"]}' score: type: object properties: min: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 max: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 description: The minimum and/or maximum global score (inclusive). example: '{"min":10,"max":1000}' assignees: type: object properties: include: type: array items: type: string exclude: type: array items: type: string exists: type: boolean detection_sources: type: object properties: include: type: array items: type: string exclude: type: array items: type: string tactics: type: object properties: include: type: array items: type: string exclude: type: array items: type: string description: Mitre Tactic ids to include or explicitly exclude from the search. Wildcards like 'TA01*' are allowed. example: '{"include":["TA0011"],"exclude":["TA01*"]}' techniques: type: object properties: include: type: array items: type: string exclude: type: array items: type: string description: Mitre Technique or sub-Technique ids to include or explicitly exclude from the search. Wildcards like 'T01*' are allowed. example: '{"include":["T0011"],"exclude":["T01*"]}' short_id: type: string description: Exact match filter for incident short_id. Accepts with or without INC- prefix. example: INC-123 created_at: type: object properties: start_date: type: string end_date: type: string description: The search range (inclusive; bounded or unbounded) of the date(s) at which incidents first arrive in conure example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' last_activity: type: object properties: start_date: type: string end_date: type: string description: The search range (inclusive; bounded or unbounded) of the date(s) at which an incident was either linked to another incident or received a new sighting. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' updated_at: type: object properties: start_date: type: string end_date: type: string description: The search range (inclusive; bounded or unbounded) of the date(s) at which incidents were last updated in conure example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' opened: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were opened. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' closed: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were closed. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' discovered: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were discovered. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' reported: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were reported. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' remediated: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were remediated. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' rejected: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were rejected. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' fields: type: array items: type: string enum: - assignees - categories - confidence - created_at - description - detection_sources - detection_status - discovery_method - external_ids - external_references - id - incident_time - intended_effect - language - last_activity - meta - owner - promotion_method - revision - schema_version - scores - severity - short_description - short_id - source - source_uri - status - tactics - techniques - title - tlp - type - updated_at description: The list of fields to return for each incident in the search results example: '["id","status","scores","description","updated_at"]' search_text: type: string description: A simple string that is searched across 'id', 'title', 'description', 'short_description', 'source', and exact short_id matches example: malicious process detected application/edn: schema: type: object properties: limit: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 offset: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 sort_by: type: array items: type: object properties: field: type: string enum: - title - scores - status - created_at - updated_at - last_activity - short_id direction: type: string enum: - asc - desc required: - field - direction filters: type: object properties: id: type: object properties: include: type: array items: type: string exclude: type: array items: type: string description: The incident ids to include or explicitly exclude from the search. example: '{"include":["7889a175-f43c-42ad-baac-ff55497c1730","incident-7889a175-f43c-42ad-baac-ff55497c1730","https://private.intel.int.iroh.site:443/ctia/incident/incident-7889a175-f43c-42ad-baac-ff55497c1730"],"exclude":["b2f76042-74f2-4697-a474-7dcdc04145f5","incident-b2f76042-74f2-4697-a474-7dcdc04145f5","https://private.intel.int.iroh.site:443/ctia/incident/incident-b2f76042-74f2-4697-a474-7dcdc04145f5"]}' status: type: object properties: include: type: array items: type: string exclude: type: array items: type: string description: The incident statuses to include or explicitly exclude from the search. example: '{"include":["New: Waiting"],"exclude":["New: Processing"]}' detection_status: type: object properties: include: type: array items: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates exclude: type: array items: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates description: The incident lifecycle (detection_status) values to include or explicitly exclude from the search. example: '{"include":["active"],"exclude":["inactive_oversized"]}' score: type: object properties: min: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 max: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 description: The minimum and/or maximum global score (inclusive). example: '{"min":10,"max":1000}' assignees: type: object properties: include: type: array items: type: string exclude: type: array items: type: string exists: type: boolean detection_sources: type: object properties: include: type: array items: type: string exclude: type: array items: type: string tactics: type: object properties: include: type: array items: type: string exclude: type: array items: type: string description: Mitre Tactic ids to include or explicitly exclude from the search. Wildcards like 'TA01*' are allowed. example: '{"include":["TA0011"],"exclude":["TA01*"]}' techniques: type: object properties: include: type: array items: type: string exclude: type: array items: type: string description: Mitre Technique or sub-Technique ids to include or explicitly exclude from the search. Wildcards like 'T01*' are allowed. example: '{"include":["T0011"],"exclude":["T01*"]}' short_id: type: string description: Exact match filter for incident short_id. Accepts with or without INC- prefix. example: INC-123 created_at: type: object properties: start_date: type: string end_date: type: string description: The search range (inclusive; bounded or unbounded) of the date(s) at which incidents first arrive in conure example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' last_activity: type: object properties: start_date: type: string end_date: type: string description: The search range (inclusive; bounded or unbounded) of the date(s) at which an incident was either linked to another incident or received a new sighting. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' updated_at: type: object properties: start_date: type: string end_date: type: string description: The search range (inclusive; bounded or unbounded) of the date(s) at which incidents were last updated in conure example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' opened: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were opened. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' closed: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were closed. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' discovered: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were discovered. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' reported: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were reported. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' remediated: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were remediated. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' rejected: type: object properties: start_date: type: string end_date: type: string description: The search range of the date(s) at which incidents were rejected. example: '{"start_date":"2025-05-01T00:00:00.000Z","end_date":"2025-05-31T23:59:59.999Z"}' fields: type: array items: type: string enum: - assignees - categories - confidence - created_at - description - detection_sources - detection_status - discovery_method - external_ids - external_references - id - incident_time - intended_effect - language - last_activity - meta - owner - promotion_method - revision - schema_version - scores - severity - short_description - short_id - source - source_uri - status - tactics - techniques - title - tlp - type - updated_at description: The list of fields to return for each incident in the search results example: '["id","status","scores","description","updated_at"]' search_text: type: string description: A simple string that is searched across 'id', 'title', 'description', 'short_description', 'source', and exact short_id matches example: malicious process detected required: true /v3/incident/{incident-id}/events: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: array items: type: object properties: compacted_entities: type: array items: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition uniqueItems: true compacted_relations: type: array items: type: object properties: source: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition related: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition relation: type: string origin: type: string required: - source - related - relation uniqueItems: true notability: type: object properties: first_seen_target: type: object properties: label: type: string targets: type: array items: {} uniqueItems: true required: - label - targets severity: type: object properties: label: type: string required: - label mitre-attack: type: object properties: label: type: string required: - label first_seen_indicator: type: object properties: label: type: string indicators: type: array items: {} uniqueItems: true required: - label - indicators original_event: type: object properties: label: type: string required: - label mitreData: type: array items: type: object properties: id: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 value: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 phase_name: type: string enum: - privilege-escalation - exfiltration - defense-evasion - initial-access - collection - execution - impact - reconnaissance - command-and-control - lateral-movement - resource-development - credential-access - discovery - persistence priority: type: integer enum: - 6 - 12 - 7 - 3 - 10 - 4 - 13 - 1 - 11 - 9 - 2 - 8 - 8 - 5 url: type: string enum: - https://attack.mitre.org/tactics/TA0004/ - https://attack.mitre.org/tactics/TA0010/ - https://attack.mitre.org/tactics/TA0005/ - https://attack.mitre.org/tactics/TA0001/ - https://attack.mitre.org/tactics/TA0009/ - https://attack.mitre.org/tactics/TA0002/ - https://attack.mitre.org/tactics/TA0040/ - https://attack.mitre.org/tactics/TA0043/ - https://attack.mitre.org/tactics/TA0011/ - https://attack.mitre.org/tactics/TA0008/ - https://attack.mitre.org/tactics/TA0042/ - https://attack.mitre.org/tactics/TA0006/ - https://attack.mitre.org/tactics/TA0007/ - https://attack.mitre.org/tactics/TA0003/ title: type: string enum: - Privilege Escalation - Exfiltration - Defense Evasion - Initial Access - Collection - Execution - Impact - Reconnaissance - Command and Control - Lateral Movement - Resource Development - Credential Access - Discovery - Persistence required: - id - value - phase_name - priority - url - title uniqueItems: true notable: type: boolean original: type: boolean indicators: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - indicator example: indicator description: The fixed value indicator schema_version: type: string example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: - string - 'null' example: string description: A description of object, which may be detailed. short_description: type: - string - 'null' example: string description: A single line, short summary of the object. source: type: - string - 'null' example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: - string - 'null' example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time range during which this Indicator is considered valid. producer: type: string example: string description: String with at most 1024 characters. severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical negate: type: boolean example: true description: Specifies the absence of the pattern. indicator_type: type: array items: type: string enum: - Anonymization - C2 - Compromised PKI Certificate - Domain Watchlist - Exfiltration - File Hash Watchlist - Host Characteristics - IMEI Watchlist - IMSI Watchlist - IP Watchlist - Login Name - Malicious E-mail - Malware Artifacts - Private Threat Feed - URL Watchlist example: Anonymization example: - Anonymization description: Specifies the type or types for this Indicator. tags: type: - array - 'null' items: type: string example: - string description: Descriptors for this indicator. composite_indicator_expression: type: object properties: operator: type: string enum: - and - not - or example: and indicator_ids: type: array items: type: string example: string description: A URI leading to an indicator. example: - string required: - operator - indicator_ids example: operator: and indicator_ids: - string likely_impact: type: string example: string description: Likely potential impact within the relevant context if this Indicator were to occur. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: level of confidence held in the accuracy of this Indicator. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: Relevant kill chain phases indicated by this Indicator. test_mechanisms: type: array items: type: string example: string description: String with at most 2048 characters. example: - string description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator. specification: type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. x-anyOf: - type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. - type: object properties: type: type: string enum: - ThreatBrain example: ThreatBrain query: type: string example: string variables: type: array items: type: string example: string example: - string required: - type - variables example: type: ThreatBrain query: string variables: - string description: An indicator which runs in threatbrain... - type: object properties: type: type: string enum: - Snort example: Snort snort_sig: type: string example: string required: - type - snort_sig example: type: Snort snort_sig: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - SIOC example: SIOC SIOC: type: string example: string required: - type - SIOC example: type: SIOC SIOC: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - OpenIOC example: OpenIOC open_IOC: type: string example: string required: - type - open_IOC example: type: OpenIOC open_IOC: string description: An indicator which contains an XML blob of an openIOC indicator. value: title: Event.Indicator.Value type: string example: W32.AdditionVariableCommandObfuscation.ioc description: The canonical label for an indicator. required: - id - producer - value example: description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: 'An indicator is a test, or a collection of judgements that define criteria for identifying the activity, or presence of malware, or other unwanted software. We follow the [STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/) closely, with the exception of not including observables within the indicator, and preferring a _specification_ object encoded in JSON as opposed to an opaque _implementation_ block. Additional, you will want to either define judgements against Observables that are linked to this indicator, with the ID in the _indicators_ field of those Judgements, or you can provide a _specification_ value.' investigationId: type: - string - 'null' investigationShortDescription: type: - string - 'null' investigationSource: type: - string - 'null' confidence: type: string enum: - High - Info - Low - Medium - None - Unknown count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 id: type: string x-anyOf: - type: string - type: string format: uuid observed_time: type: object properties: start_time: type: string end_time: type: - string - 'null' required: - start_time type: type: string enum: - sighting context: {} data: type: object properties: columns: type: array items: type: object properties: name: type: string type: type: string enum: - integer - markdown - number - observable - string - url description: type: - string - 'null' required: type: boolean short_description: type: - string - 'null' required: - name - type rows: type: array items: {} row_count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - columns - rows external_ids: type: array items: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name internal: type: boolean language: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 resolution: type: string enum: - allowed - blocked - contained - detected sensor: type: string sensor_coordinates: type: object properties: observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value os: type: string type: type: string required: - observables - type severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_description: type: string source: type: string source_uri: type: string timestamp: type: string title: type: - string - 'null' tactics_and_techniques: type: array items: title: Mitre tactics and Techniques type: object properties: id: title: MitreID type: string example: TA0003 description: MITRE ATT&CK ID external_id: title: MitreExternalId type: string example: TA0003 description: MITRE ATT&CK ID title: title: MitreTitle type: string example: Persistence short_description: title: MitreShortDescription type: - string - 'null' example: Persistence description: title: MitreDescription type: string example: 'The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.' score: title: MitreScore type: - integer - 'null' format: int64 minimum: 1 maximum: 1000 example: 44 source_url: title: MitreSourceURL type: - string - 'null' example: https://attack.mitre.org/techniques/TA0003 description: The source url for this tactic or technique mitre_type: type: string enum: - tactic - technique - subtechnique required: - id - external_id - title - short_description - description - score - source_url - mitre_type description: A MITRE object from https://attack.mitre.org/ tlp: type: string enum: - amber - green - red - white required: - notable - original - confidence - count - id - observed_time - type application/transit+msgpack: schema: type: array items: type: object properties: compacted_entities: type: array items: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition uniqueItems: true compacted_relations: type: array items: type: object properties: source: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition related: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition relation: type: string origin: type: string required: - source - related - relation uniqueItems: true notability: type: object properties: first_seen_target: type: object properties: label: type: string targets: type: array items: {} uniqueItems: true required: - label - targets severity: type: object properties: label: type: string required: - label mitre-attack: type: object properties: label: type: string required: - label first_seen_indicator: type: object properties: label: type: string indicators: type: array items: {} uniqueItems: true required: - label - indicators original_event: type: object properties: label: type: string required: - label mitreData: type: array items: type: object properties: id: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 value: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 phase_name: type: string enum: - privilege-escalation - exfiltration - defense-evasion - initial-access - collection - execution - impact - reconnaissance - command-and-control - lateral-movement - resource-development - credential-access - discovery - persistence priority: type: integer enum: - 6 - 12 - 7 - 3 - 10 - 4 - 13 - 1 - 11 - 9 - 2 - 8 - 8 - 5 url: type: string enum: - https://attack.mitre.org/tactics/TA0004/ - https://attack.mitre.org/tactics/TA0010/ - https://attack.mitre.org/tactics/TA0005/ - https://attack.mitre.org/tactics/TA0001/ - https://attack.mitre.org/tactics/TA0009/ - https://attack.mitre.org/tactics/TA0002/ - https://attack.mitre.org/tactics/TA0040/ - https://attack.mitre.org/tactics/TA0043/ - https://attack.mitre.org/tactics/TA0011/ - https://attack.mitre.org/tactics/TA0008/ - https://attack.mitre.org/tactics/TA0042/ - https://attack.mitre.org/tactics/TA0006/ - https://attack.mitre.org/tactics/TA0007/ - https://attack.mitre.org/tactics/TA0003/ title: type: string enum: - Privilege Escalation - Exfiltration - Defense Evasion - Initial Access - Collection - Execution - Impact - Reconnaissance - Command and Control - Lateral Movement - Resource Development - Credential Access - Discovery - Persistence required: - id - value - phase_name - priority - url - title uniqueItems: true notable: type: boolean original: type: boolean indicators: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - indicator example: indicator description: The fixed value indicator schema_version: type: string example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: - string - 'null' example: string description: A description of object, which may be detailed. short_description: type: - string - 'null' example: string description: A single line, short summary of the object. source: type: - string - 'null' example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: - string - 'null' example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time range during which this Indicator is considered valid. producer: type: string example: string description: String with at most 1024 characters. severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical negate: type: boolean example: true description: Specifies the absence of the pattern. indicator_type: type: array items: type: string enum: - Anonymization - C2 - Compromised PKI Certificate - Domain Watchlist - Exfiltration - File Hash Watchlist - Host Characteristics - IMEI Watchlist - IMSI Watchlist - IP Watchlist - Login Name - Malicious E-mail - Malware Artifacts - Private Threat Feed - URL Watchlist example: Anonymization example: - Anonymization description: Specifies the type or types for this Indicator. tags: type: - array - 'null' items: type: string example: - string description: Descriptors for this indicator. composite_indicator_expression: type: object properties: operator: type: string enum: - and - not - or example: and indicator_ids: type: array items: type: string example: string description: A URI leading to an indicator. example: - string required: - operator - indicator_ids example: operator: and indicator_ids: - string likely_impact: type: string example: string description: Likely potential impact within the relevant context if this Indicator were to occur. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: level of confidence held in the accuracy of this Indicator. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: Relevant kill chain phases indicated by this Indicator. test_mechanisms: type: array items: type: string example: string description: String with at most 2048 characters. example: - string description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator. specification: type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. x-anyOf: - type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. - type: object properties: type: type: string enum: - ThreatBrain example: ThreatBrain query: type: string example: string variables: type: array items: type: string example: string example: - string required: - type - variables example: type: ThreatBrain query: string variables: - string description: An indicator which runs in threatbrain... - type: object properties: type: type: string enum: - Snort example: Snort snort_sig: type: string example: string required: - type - snort_sig example: type: Snort snort_sig: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - SIOC example: SIOC SIOC: type: string example: string required: - type - SIOC example: type: SIOC SIOC: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - OpenIOC example: OpenIOC open_IOC: type: string example: string required: - type - open_IOC example: type: OpenIOC open_IOC: string description: An indicator which contains an XML blob of an openIOC indicator. value: title: Event.Indicator.Value type: string example: W32.AdditionVariableCommandObfuscation.ioc description: The canonical label for an indicator. required: - id - producer - value example: description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: 'An indicator is a test, or a collection of judgements that define criteria for identifying the activity, or presence of malware, or other unwanted software. We follow the [STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/) closely, with the exception of not including observables within the indicator, and preferring a _specification_ object encoded in JSON as opposed to an opaque _implementation_ block. Additional, you will want to either define judgements against Observables that are linked to this indicator, with the ID in the _indicators_ field of those Judgements, or you can provide a _specification_ value.' investigationId: type: - string - 'null' investigationShortDescription: type: - string - 'null' investigationSource: type: - string - 'null' confidence: type: string enum: - High - Info - Low - Medium - None - Unknown count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 id: type: string x-anyOf: - type: string - type: string format: uuid observed_time: type: object properties: start_time: type: string end_time: type: - string - 'null' required: - start_time type: type: string enum: - sighting context: {} data: type: object properties: columns: type: array items: type: object properties: name: type: string type: type: string enum: - integer - markdown - number - observable - string - url description: type: - string - 'null' required: type: boolean short_description: type: - string - 'null' required: - name - type rows: type: array items: {} row_count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - columns - rows external_ids: type: array items: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name internal: type: boolean language: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 resolution: type: string enum: - allowed - blocked - contained - detected sensor: type: string sensor_coordinates: type: object properties: observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value os: type: string type: type: string required: - observables - type severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_description: type: string source: type: string source_uri: type: string timestamp: type: string title: type: - string - 'null' tactics_and_techniques: type: array items: title: Mitre tactics and Techniques type: object properties: id: title: MitreID type: string example: TA0003 description: MITRE ATT&CK ID external_id: title: MitreExternalId type: string example: TA0003 description: MITRE ATT&CK ID title: title: MitreTitle type: string example: Persistence short_description: title: MitreShortDescription type: - string - 'null' example: Persistence description: title: MitreDescription type: string example: 'The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.' score: title: MitreScore type: - integer - 'null' format: int64 minimum: 1 maximum: 1000 example: 44 source_url: title: MitreSourceURL type: - string - 'null' example: https://attack.mitre.org/techniques/TA0003 description: The source url for this tactic or technique mitre_type: type: string enum: - tactic - technique - subtechnique required: - id - external_id - title - short_description - description - score - source_url - mitre_type description: A MITRE object from https://attack.mitre.org/ tlp: type: string enum: - amber - green - red - white required: - notable - original - confidence - count - id - observed_time - type application/transit+json: schema: type: array items: type: object properties: compacted_entities: type: array items: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition uniqueItems: true compacted_relations: type: array items: type: object properties: source: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition related: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition relation: type: string origin: type: string required: - source - related - relation uniqueItems: true notability: type: object properties: first_seen_target: type: object properties: label: type: string targets: type: array items: {} uniqueItems: true required: - label - targets severity: type: object properties: label: type: string required: - label mitre-attack: type: object properties: label: type: string required: - label first_seen_indicator: type: object properties: label: type: string indicators: type: array items: {} uniqueItems: true required: - label - indicators original_event: type: object properties: label: type: string required: - label mitreData: type: array items: type: object properties: id: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 value: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 phase_name: type: string enum: - privilege-escalation - exfiltration - defense-evasion - initial-access - collection - execution - impact - reconnaissance - command-and-control - lateral-movement - resource-development - credential-access - discovery - persistence priority: type: integer enum: - 6 - 12 - 7 - 3 - 10 - 4 - 13 - 1 - 11 - 9 - 2 - 8 - 8 - 5 url: type: string enum: - https://attack.mitre.org/tactics/TA0004/ - https://attack.mitre.org/tactics/TA0010/ - https://attack.mitre.org/tactics/TA0005/ - https://attack.mitre.org/tactics/TA0001/ - https://attack.mitre.org/tactics/TA0009/ - https://attack.mitre.org/tactics/TA0002/ - https://attack.mitre.org/tactics/TA0040/ - https://attack.mitre.org/tactics/TA0043/ - https://attack.mitre.org/tactics/TA0011/ - https://attack.mitre.org/tactics/TA0008/ - https://attack.mitre.org/tactics/TA0042/ - https://attack.mitre.org/tactics/TA0006/ - https://attack.mitre.org/tactics/TA0007/ - https://attack.mitre.org/tactics/TA0003/ title: type: string enum: - Privilege Escalation - Exfiltration - Defense Evasion - Initial Access - Collection - Execution - Impact - Reconnaissance - Command and Control - Lateral Movement - Resource Development - Credential Access - Discovery - Persistence required: - id - value - phase_name - priority - url - title uniqueItems: true notable: type: boolean original: type: boolean indicators: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - indicator example: indicator description: The fixed value indicator schema_version: type: string example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: - string - 'null' example: string description: A description of object, which may be detailed. short_description: type: - string - 'null' example: string description: A single line, short summary of the object. source: type: - string - 'null' example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: - string - 'null' example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time range during which this Indicator is considered valid. producer: type: string example: string description: String with at most 1024 characters. severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical negate: type: boolean example: true description: Specifies the absence of the pattern. indicator_type: type: array items: type: string enum: - Anonymization - C2 - Compromised PKI Certificate - Domain Watchlist - Exfiltration - File Hash Watchlist - Host Characteristics - IMEI Watchlist - IMSI Watchlist - IP Watchlist - Login Name - Malicious E-mail - Malware Artifacts - Private Threat Feed - URL Watchlist example: Anonymization example: - Anonymization description: Specifies the type or types for this Indicator. tags: type: - array - 'null' items: type: string example: - string description: Descriptors for this indicator. composite_indicator_expression: type: object properties: operator: type: string enum: - and - not - or example: and indicator_ids: type: array items: type: string example: string description: A URI leading to an indicator. example: - string required: - operator - indicator_ids example: operator: and indicator_ids: - string likely_impact: type: string example: string description: Likely potential impact within the relevant context if this Indicator were to occur. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: level of confidence held in the accuracy of this Indicator. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: Relevant kill chain phases indicated by this Indicator. test_mechanisms: type: array items: type: string example: string description: String with at most 2048 characters. example: - string description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator. specification: type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. x-anyOf: - type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. - type: object properties: type: type: string enum: - ThreatBrain example: ThreatBrain query: type: string example: string variables: type: array items: type: string example: string example: - string required: - type - variables example: type: ThreatBrain query: string variables: - string description: An indicator which runs in threatbrain... - type: object properties: type: type: string enum: - Snort example: Snort snort_sig: type: string example: string required: - type - snort_sig example: type: Snort snort_sig: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - SIOC example: SIOC SIOC: type: string example: string required: - type - SIOC example: type: SIOC SIOC: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - OpenIOC example: OpenIOC open_IOC: type: string example: string required: - type - open_IOC example: type: OpenIOC open_IOC: string description: An indicator which contains an XML blob of an openIOC indicator. value: title: Event.Indicator.Value type: string example: W32.AdditionVariableCommandObfuscation.ioc description: The canonical label for an indicator. required: - id - producer - value example: description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: 'An indicator is a test, or a collection of judgements that define criteria for identifying the activity, or presence of malware, or other unwanted software. We follow the [STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/) closely, with the exception of not including observables within the indicator, and preferring a _specification_ object encoded in JSON as opposed to an opaque _implementation_ block. Additional, you will want to either define judgements against Observables that are linked to this indicator, with the ID in the _indicators_ field of those Judgements, or you can provide a _specification_ value.' investigationId: type: - string - 'null' investigationShortDescription: type: - string - 'null' investigationSource: type: - string - 'null' confidence: type: string enum: - High - Info - Low - Medium - None - Unknown count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 id: type: string x-anyOf: - type: string - type: string format: uuid observed_time: type: object properties: start_time: type: string end_time: type: - string - 'null' required: - start_time type: type: string enum: - sighting context: {} data: type: object properties: columns: type: array items: type: object properties: name: type: string type: type: string enum: - integer - markdown - number - observable - string - url description: type: - string - 'null' required: type: boolean short_description: type: - string - 'null' required: - name - type rows: type: array items: {} row_count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - columns - rows external_ids: type: array items: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name internal: type: boolean language: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 resolution: type: string enum: - allowed - blocked - contained - detected sensor: type: string sensor_coordinates: type: object properties: observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value os: type: string type: type: string required: - observables - type severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_description: type: string source: type: string source_uri: type: string timestamp: type: string title: type: - string - 'null' tactics_and_techniques: type: array items: title: Mitre tactics and Techniques type: object properties: id: title: MitreID type: string example: TA0003 description: MITRE ATT&CK ID external_id: title: MitreExternalId type: string example: TA0003 description: MITRE ATT&CK ID title: title: MitreTitle type: string example: Persistence short_description: title: MitreShortDescription type: - string - 'null' example: Persistence description: title: MitreDescription type: string example: 'The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.' score: title: MitreScore type: - integer - 'null' format: int64 minimum: 1 maximum: 1000 example: 44 source_url: title: MitreSourceURL type: - string - 'null' example: https://attack.mitre.org/techniques/TA0003 description: The source url for this tactic or technique mitre_type: type: string enum: - tactic - technique - subtechnique required: - id - external_id - title - short_description - description - score - source_url - mitre_type description: A MITRE object from https://attack.mitre.org/ tlp: type: string enum: - amber - green - red - white required: - notable - original - confidence - count - id - observed_time - type application/edn: schema: type: array items: type: object properties: compacted_entities: type: array items: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition uniqueItems: true compacted_relations: type: array items: type: object properties: source: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition related: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition relation: type: string origin: type: string required: - source - related - relation uniqueItems: true notability: type: object properties: first_seen_target: type: object properties: label: type: string targets: type: array items: {} uniqueItems: true required: - label - targets severity: type: object properties: label: type: string required: - label mitre-attack: type: object properties: label: type: string required: - label first_seen_indicator: type: object properties: label: type: string indicators: type: array items: {} uniqueItems: true required: - label - indicators original_event: type: object properties: label: type: string required: - label mitreData: type: array items: type: object properties: id: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 value: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 phase_name: type: string enum: - privilege-escalation - exfiltration - defense-evasion - initial-access - collection - execution - impact - reconnaissance - command-and-control - lateral-movement - resource-development - credential-access - discovery - persistence priority: type: integer enum: - 6 - 12 - 7 - 3 - 10 - 4 - 13 - 1 - 11 - 9 - 2 - 8 - 8 - 5 url: type: string enum: - https://attack.mitre.org/tactics/TA0004/ - https://attack.mitre.org/tactics/TA0010/ - https://attack.mitre.org/tactics/TA0005/ - https://attack.mitre.org/tactics/TA0001/ - https://attack.mitre.org/tactics/TA0009/ - https://attack.mitre.org/tactics/TA0002/ - https://attack.mitre.org/tactics/TA0040/ - https://attack.mitre.org/tactics/TA0043/ - https://attack.mitre.org/tactics/TA0011/ - https://attack.mitre.org/tactics/TA0008/ - https://attack.mitre.org/tactics/TA0042/ - https://attack.mitre.org/tactics/TA0006/ - https://attack.mitre.org/tactics/TA0007/ - https://attack.mitre.org/tactics/TA0003/ title: type: string enum: - Privilege Escalation - Exfiltration - Defense Evasion - Initial Access - Collection - Execution - Impact - Reconnaissance - Command and Control - Lateral Movement - Resource Development - Credential Access - Discovery - Persistence required: - id - value - phase_name - priority - url - title uniqueItems: true notable: type: boolean original: type: boolean indicators: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - indicator example: indicator description: The fixed value indicator schema_version: type: string example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: - string - 'null' example: string description: A description of object, which may be detailed. short_description: type: - string - 'null' example: string description: A single line, short summary of the object. source: type: - string - 'null' example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: - string - 'null' example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time range during which this Indicator is considered valid. producer: type: string example: string description: String with at most 1024 characters. severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical negate: type: boolean example: true description: Specifies the absence of the pattern. indicator_type: type: array items: type: string enum: - Anonymization - C2 - Compromised PKI Certificate - Domain Watchlist - Exfiltration - File Hash Watchlist - Host Characteristics - IMEI Watchlist - IMSI Watchlist - IP Watchlist - Login Name - Malicious E-mail - Malware Artifacts - Private Threat Feed - URL Watchlist example: Anonymization example: - Anonymization description: Specifies the type or types for this Indicator. tags: type: - array - 'null' items: type: string example: - string description: Descriptors for this indicator. composite_indicator_expression: type: object properties: operator: type: string enum: - and - not - or example: and indicator_ids: type: array items: type: string example: string description: A URI leading to an indicator. example: - string required: - operator - indicator_ids example: operator: and indicator_ids: - string likely_impact: type: string example: string description: Likely potential impact within the relevant context if this Indicator were to occur. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: level of confidence held in the accuracy of this Indicator. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: Relevant kill chain phases indicated by this Indicator. test_mechanisms: type: array items: type: string example: string description: String with at most 2048 characters. example: - string description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator. specification: type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. x-anyOf: - type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. - type: object properties: type: type: string enum: - ThreatBrain example: ThreatBrain query: type: string example: string variables: type: array items: type: string example: string example: - string required: - type - variables example: type: ThreatBrain query: string variables: - string description: An indicator which runs in threatbrain... - type: object properties: type: type: string enum: - Snort example: Snort snort_sig: type: string example: string required: - type - snort_sig example: type: Snort snort_sig: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - SIOC example: SIOC SIOC: type: string example: string required: - type - SIOC example: type: SIOC SIOC: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - OpenIOC example: OpenIOC open_IOC: type: string example: string required: - type - open_IOC example: type: OpenIOC open_IOC: string description: An indicator which contains an XML blob of an openIOC indicator. value: title: Event.Indicator.Value type: string example: W32.AdditionVariableCommandObfuscation.ioc description: The canonical label for an indicator. required: - id - producer - value example: description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: 'An indicator is a test, or a collection of judgements that define criteria for identifying the activity, or presence of malware, or other unwanted software. We follow the [STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/) closely, with the exception of not including observables within the indicator, and preferring a _specification_ object encoded in JSON as opposed to an opaque _implementation_ block. Additional, you will want to either define judgements against Observables that are linked to this indicator, with the ID in the _indicators_ field of those Judgements, or you can provide a _specification_ value.' investigationId: type: - string - 'null' investigationShortDescription: type: - string - 'null' investigationSource: type: - string - 'null' confidence: type: string enum: - High - Info - Low - Medium - None - Unknown count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 id: type: string x-anyOf: - type: string - type: string format: uuid observed_time: type: object properties: start_time: type: string end_time: type: - string - 'null' required: - start_time type: type: string enum: - sighting context: {} data: type: object properties: columns: type: array items: type: object properties: name: type: string type: type: string enum: - integer - markdown - number - observable - string - url description: type: - string - 'null' required: type: boolean short_description: type: - string - 'null' required: - name - type rows: type: array items: {} row_count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - columns - rows external_ids: type: array items: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name internal: type: boolean language: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 resolution: type: string enum: - allowed - blocked - contained - detected sensor: type: string sensor_coordinates: type: object properties: observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value os: type: string type: type: string required: - observables - type severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_description: type: string source: type: string source_uri: type: string timestamp: type: string title: type: - string - 'null' tactics_and_techniques: type: array items: title: Mitre tactics and Techniques type: object properties: id: title: MitreID type: string example: TA0003 description: MITRE ATT&CK ID external_id: title: MitreExternalId type: string example: TA0003 description: MITRE ATT&CK ID title: title: MitreTitle type: string example: Persistence short_description: title: MitreShortDescription type: - string - 'null' example: Persistence description: title: MitreDescription type: string example: 'The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.' score: title: MitreScore type: - integer - 'null' format: int64 minimum: 1 maximum: 1000 example: 44 source_url: title: MitreSourceURL type: - string - 'null' example: https://attack.mitre.org/techniques/TA0003 description: The source url for this tactic or technique mitre_type: type: string enum: - tactic - technique - subtechnique required: - id - external_id - title - short_description - description - score - source_url - mitre_type description: A MITRE object from https://attack.mitre.org/ tlp: type: string enum: - amber - green - red - white required: - notable - original - confidence - count - id - observed_time - type '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: path name: incident-id description: The non-URL qualified ID of the incident you would like to retrieve related events for. required: true example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14 schema: type: string - description: A integer greater than 0. name: limit title: PositiveInteger example: 2 required: false in: query schema: type: integer format: int64 minimum: 0 - description: A integer greater than 0. name: offset title: PositiveInteger example: 2 required: false in: query schema: type: integer format: int64 minimum: 0 - in: query name: sort description: '' required: false allowEmptyValue: true schema: type: string enum: - asc - desc - in: query name: order description: '' required: false allowEmptyValue: true schema: type: string enum: - start_time - time - title - severity - source - in: query name: important_only description: Include only important events required: false schema: type: boolean - in: query name: notable description: '' required: false schema: type: boolean - in: query name: source description: '' required: false x-anyOf: - type: array items: type: string - type: string allowEmptyValue: true schema: type: array items: type: string - in: query name: severity description: '' required: false x-anyOf: - type: array items: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown - type: string allowEmptyValue: true schema: type: array items: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown - in: query name: type description: '' required: false x-anyOf: - type: array items: type: string enum: - Original - Investigated - type: string allowEmptyValue: true schema: type: array items: type: string enum: - Original - Investigated - in: query name: search_text description: '' required: false schema: type: string tags: - v3 summary: Incident Events security: - JWT-Bearer: [] - oauth2: [] /v3/incident/{incident-id}/storyboard: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: {} application/transit+msgpack: schema: {} application/transit+json: schema: {} application/edn: schema: {} '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: path name: incident-id description: The non-URL qualified ID of the incident you would like to retrieve related events for. required: true example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14 schema: type: string tags: - v3 summary: XDR 2.0 Output for Incidents security: - JWT-Bearer: [] - oauth2: [] /v3/incident/{incident-id}/storyboard/feedback: post: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '201': description: '' content: application/json: schema: {} application/transit+msgpack: schema: {} application/transit+json: schema: {} application/edn: schema: {} '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: path name: incident-id description: The non-URL qualified ID of the incident you would like to retrieve related events for. required: true example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14 schema: type: string tags: - v3 summary: Submit storyboard feedback for an incident security: - JWT-Bearer: [] - oauth2: [] requestBody: content: application/json: schema: type: object properties: type: type: string enum: - general - verdict report_metadata: type: object properties: langsmith_trace_id: type: string minLength: 1 maxLength: 300 xdr_chain_id: type: string minLength: 1 maxLength: 300 required: - langsmith_trace_id - xdr_chain_id feedback_metadata: type: - object - 'null' properties: status: type: string minLength: 1 maxLength: 300 text: type: string minLength: 1 maxLength: 6000 required: - type - report_metadata - feedback_metadata - text application/transit+msgpack: schema: type: object properties: type: type: string enum: - general - verdict report_metadata: type: object properties: langsmith_trace_id: type: string minLength: 1 maxLength: 300 xdr_chain_id: type: string minLength: 1 maxLength: 300 required: - langsmith_trace_id - xdr_chain_id feedback_metadata: type: - object - 'null' properties: status: type: string minLength: 1 maxLength: 300 text: type: string minLength: 1 maxLength: 6000 required: - type - report_metadata - feedback_metadata - text application/transit+json: schema: type: object properties: type: type: string enum: - general - verdict report_metadata: type: object properties: langsmith_trace_id: type: string minLength: 1 maxLength: 300 xdr_chain_id: type: string minLength: 1 maxLength: 300 required: - langsmith_trace_id - xdr_chain_id feedback_metadata: type: - object - 'null' properties: status: type: string minLength: 1 maxLength: 300 text: type: string minLength: 1 maxLength: 6000 required: - type - report_metadata - feedback_metadata - text application/edn: schema: type: object properties: type: type: string enum: - general - verdict report_metadata: type: object properties: langsmith_trace_id: type: string minLength: 1 maxLength: 300 xdr_chain_id: type: string minLength: 1 maxLength: 300 required: - langsmith_trace_id - xdr_chain_id feedback_metadata: type: - object - 'null' properties: status: type: string minLength: 1 maxLength: 300 text: type: string minLength: 1 maxLength: 6000 required: - type - report_metadata - feedback_metadata - text required: true /v3/incident/{incident-id}/graph: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: object properties: nodes: type: object additionalProperties: type: object properties: data: type: object properties: type: type: string value: type: string asset_id: type: string disposition: type: integer format: int64 indicators: type: array items: type: string uniqueItems: true internal: type: boolean incoming-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true outgoing-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true investigated: type: boolean is_asset: type: boolean observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. disposition: type: integer format: int64 investigated: type: boolean required: - type - value - disposition - investigated properties: type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true x-anyOf: - type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true - type: array items: type: object properties: name: type: string value: {} required: - name - value modules: type: array items: type: string uniqueItems: true sightings: type: array items: type: string uniqueItems: true sources: type: array items: type: string uniqueItems: true title: type: string actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. required: - type - value - indicators - internal - incoming-edges - outgoing-edges - investigated - is_asset - observableType - observables - modules - sightings - sources - title times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true required: - data - times edges: type: object additionalProperties: type: object properties: id1: type: string id2: type: string times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true data: type: object properties: observed_times: type: array items: type: string uniqueItems: true value: type: string sightings: type: array items: type: string uniqueItems: true relation_info: {} required: - value - sightings required: - id1 - id2 - times - data errors: type: array items: type: object properties: type: type: string enum: - E_DATA_TOO_LARGE message: type: string required: - type - message required: - nodes - edges application/transit+msgpack: schema: type: object properties: nodes: type: object additionalProperties: type: object properties: data: type: object properties: type: type: string value: type: string asset_id: type: string disposition: type: integer format: int64 indicators: type: array items: type: string uniqueItems: true internal: type: boolean incoming-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true outgoing-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true investigated: type: boolean is_asset: type: boolean observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. disposition: type: integer format: int64 investigated: type: boolean required: - type - value - disposition - investigated properties: type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true x-anyOf: - type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true - type: array items: type: object properties: name: type: string value: {} required: - name - value modules: type: array items: type: string uniqueItems: true sightings: type: array items: type: string uniqueItems: true sources: type: array items: type: string uniqueItems: true title: type: string actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. required: - type - value - indicators - internal - incoming-edges - outgoing-edges - investigated - is_asset - observableType - observables - modules - sightings - sources - title times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true required: - data - times edges: type: object additionalProperties: type: object properties: id1: type: string id2: type: string times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true data: type: object properties: observed_times: type: array items: type: string uniqueItems: true value: type: string sightings: type: array items: type: string uniqueItems: true relation_info: {} required: - value - sightings required: - id1 - id2 - times - data errors: type: array items: type: object properties: type: type: string enum: - E_DATA_TOO_LARGE message: type: string required: - type - message required: - nodes - edges application/transit+json: schema: type: object properties: nodes: type: object additionalProperties: type: object properties: data: type: object properties: type: type: string value: type: string asset_id: type: string disposition: type: integer format: int64 indicators: type: array items: type: string uniqueItems: true internal: type: boolean incoming-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true outgoing-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true investigated: type: boolean is_asset: type: boolean observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. disposition: type: integer format: int64 investigated: type: boolean required: - type - value - disposition - investigated properties: type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true x-anyOf: - type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true - type: array items: type: object properties: name: type: string value: {} required: - name - value modules: type: array items: type: string uniqueItems: true sightings: type: array items: type: string uniqueItems: true sources: type: array items: type: string uniqueItems: true title: type: string actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. required: - type - value - indicators - internal - incoming-edges - outgoing-edges - investigated - is_asset - observableType - observables - modules - sightings - sources - title times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true required: - data - times edges: type: object additionalProperties: type: object properties: id1: type: string id2: type: string times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true data: type: object properties: observed_times: type: array items: type: string uniqueItems: true value: type: string sightings: type: array items: type: string uniqueItems: true relation_info: {} required: - value - sightings required: - id1 - id2 - times - data errors: type: array items: type: object properties: type: type: string enum: - E_DATA_TOO_LARGE message: type: string required: - type - message required: - nodes - edges application/edn: schema: type: object properties: nodes: type: object additionalProperties: type: object properties: data: type: object properties: type: type: string value: type: string asset_id: type: string disposition: type: integer format: int64 indicators: type: array items: type: string uniqueItems: true internal: type: boolean incoming-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true outgoing-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true investigated: type: boolean is_asset: type: boolean observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. disposition: type: integer format: int64 investigated: type: boolean required: - type - value - disposition - investigated properties: type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true x-anyOf: - type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true - type: array items: type: object properties: name: type: string value: {} required: - name - value modules: type: array items: type: string uniqueItems: true sightings: type: array items: type: string uniqueItems: true sources: type: array items: type: string uniqueItems: true title: type: string actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. required: - type - value - indicators - internal - incoming-edges - outgoing-edges - investigated - is_asset - observableType - observables - modules - sightings - sources - title times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true required: - data - times edges: type: object additionalProperties: type: object properties: id1: type: string id2: type: string times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true data: type: object properties: observed_times: type: array items: type: string uniqueItems: true value: type: string sightings: type: array items: type: string uniqueItems: true relation_info: {} required: - value - sightings required: - id1 - id2 - times - data errors: type: array items: type: object properties: type: type: string enum: - E_DATA_TOO_LARGE message: type: string required: - type - message required: - nodes - edges '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: path name: incident-id description: The non-URL qualified ID of the incident you would like to retrieve related events for. required: true example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14 schema: type: string - in: query name: important_observables description: Include only data that is related to an important observable required: false schema: type: boolean - in: query name: important_sightings description: Include only data from important events required: false schema: type: boolean - in: query name: important_only description: Include only data from important events required: false schema: type: boolean - in: query name: include_process_parents description: Include parent processes when rendering execution relationships required: false schema: type: boolean tags: - v3 summary: Graph Endpoint from entities. security: - JWT-Bearer: [] - oauth2: [] post: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: object properties: nodes: type: object additionalProperties: type: object properties: data: type: object properties: type: type: string value: type: string asset_id: type: string disposition: type: integer format: int64 indicators: type: array items: type: string uniqueItems: true internal: type: boolean incoming-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true outgoing-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true investigated: type: boolean is_asset: type: boolean observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. disposition: type: integer format: int64 investigated: type: boolean required: - type - value - disposition - investigated properties: type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true x-anyOf: - type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true - type: array items: type: object properties: name: type: string value: {} required: - name - value modules: type: array items: type: string uniqueItems: true sightings: type: array items: type: string uniqueItems: true sources: type: array items: type: string uniqueItems: true title: type: string actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. required: - type - value - indicators - internal - incoming-edges - outgoing-edges - investigated - is_asset - observableType - observables - modules - sightings - sources - title times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true required: - data - times edges: type: object additionalProperties: type: object properties: id1: type: string id2: type: string times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true data: type: object properties: observed_times: type: array items: type: string uniqueItems: true value: type: string sightings: type: array items: type: string uniqueItems: true relation_info: {} required: - value - sightings required: - id1 - id2 - times - data errors: type: array items: type: object properties: type: type: string enum: - E_DATA_TOO_LARGE message: type: string required: - type - message required: - nodes - edges application/transit+msgpack: schema: type: object properties: nodes: type: object additionalProperties: type: object properties: data: type: object properties: type: type: string value: type: string asset_id: type: string disposition: type: integer format: int64 indicators: type: array items: type: string uniqueItems: true internal: type: boolean incoming-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true outgoing-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true investigated: type: boolean is_asset: type: boolean observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. disposition: type: integer format: int64 investigated: type: boolean required: - type - value - disposition - investigated properties: type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true x-anyOf: - type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true - type: array items: type: object properties: name: type: string value: {} required: - name - value modules: type: array items: type: string uniqueItems: true sightings: type: array items: type: string uniqueItems: true sources: type: array items: type: string uniqueItems: true title: type: string actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. required: - type - value - indicators - internal - incoming-edges - outgoing-edges - investigated - is_asset - observableType - observables - modules - sightings - sources - title times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true required: - data - times edges: type: object additionalProperties: type: object properties: id1: type: string id2: type: string times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true data: type: object properties: observed_times: type: array items: type: string uniqueItems: true value: type: string sightings: type: array items: type: string uniqueItems: true relation_info: {} required: - value - sightings required: - id1 - id2 - times - data errors: type: array items: type: object properties: type: type: string enum: - E_DATA_TOO_LARGE message: type: string required: - type - message required: - nodes - edges application/transit+json: schema: type: object properties: nodes: type: object additionalProperties: type: object properties: data: type: object properties: type: type: string value: type: string asset_id: type: string disposition: type: integer format: int64 indicators: type: array items: type: string uniqueItems: true internal: type: boolean incoming-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true outgoing-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true investigated: type: boolean is_asset: type: boolean observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. disposition: type: integer format: int64 investigated: type: boolean required: - type - value - disposition - investigated properties: type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true x-anyOf: - type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true - type: array items: type: object properties: name: type: string value: {} required: - name - value modules: type: array items: type: string uniqueItems: true sightings: type: array items: type: string uniqueItems: true sources: type: array items: type: string uniqueItems: true title: type: string actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. required: - type - value - indicators - internal - incoming-edges - outgoing-edges - investigated - is_asset - observableType - observables - modules - sightings - sources - title times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true required: - data - times edges: type: object additionalProperties: type: object properties: id1: type: string id2: type: string times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true data: type: object properties: observed_times: type: array items: type: string uniqueItems: true value: type: string sightings: type: array items: type: string uniqueItems: true relation_info: {} required: - value - sightings required: - id1 - id2 - times - data errors: type: array items: type: object properties: type: type: string enum: - E_DATA_TOO_LARGE message: type: string required: - type - message required: - nodes - edges application/edn: schema: type: object properties: nodes: type: object additionalProperties: type: object properties: data: type: object properties: type: type: string value: type: string asset_id: type: string disposition: type: integer format: int64 indicators: type: array items: type: string uniqueItems: true internal: type: boolean incoming-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true outgoing-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true investigated: type: boolean is_asset: type: boolean observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. disposition: type: integer format: int64 investigated: type: boolean required: - type - value - disposition - investigated properties: type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true x-anyOf: - type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true - type: array items: type: object properties: name: type: string value: {} required: - name - value modules: type: array items: type: string uniqueItems: true sightings: type: array items: type: string uniqueItems: true sources: type: array items: type: string uniqueItems: true title: type: string actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. required: - type - value - indicators - internal - incoming-edges - outgoing-edges - investigated - is_asset - observableType - observables - modules - sightings - sources - title times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true required: - data - times edges: type: object additionalProperties: type: object properties: id1: type: string id2: type: string times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true data: type: object properties: observed_times: type: array items: type: string uniqueItems: true value: type: string sightings: type: array items: type: string uniqueItems: true relation_info: {} required: - value - sightings required: - id1 - id2 - times - data errors: type: array items: type: object properties: type: type: string enum: - E_DATA_TOO_LARGE message: type: string required: - type - message required: - nodes - edges '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: path name: incident-id description: The non-URL qualified ID of the incident you would like to retrieve related events for. required: true example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14 schema: type: string - in: query name: important_observables description: Include only data that is related to an important observable required: false schema: type: boolean - in: query name: important_sightings description: Include only data from important events required: false schema: type: boolean - in: query name: important_only description: Include only data from important events required: false schema: type: boolean - in: query name: include_process_parents description: Include parent processes when rendering execution relationships required: false schema: type: boolean tags: - v3 summary: Graph Endpoint from entities. security: - JWT-Bearer: [] - oauth2: [] requestBody: content: application/json: schema: type: - object - 'null' properties: important_observables: description: Include only data that is related to an important observable type: boolean important_sightings: description: Include only data from important events type: boolean important_only: description: Include only data from important events type: boolean include_process_parents: description: Include parent processes when rendering execution relationships type: boolean application/transit+msgpack: schema: type: - object - 'null' properties: important_observables: description: Include only data that is related to an important observable type: boolean important_sightings: description: Include only data from important events type: boolean important_only: description: Include only data from important events type: boolean include_process_parents: description: Include parent processes when rendering execution relationships type: boolean application/transit+json: schema: type: - object - 'null' properties: important_observables: description: Include only data that is related to an important observable type: boolean important_sightings: description: Include only data from important events type: boolean important_only: description: Include only data from important events type: boolean include_process_parents: description: Include parent processes when rendering execution relationships type: boolean application/edn: schema: type: - object - 'null' properties: important_observables: description: Include only data that is related to an important observable type: boolean important_sightings: description: Include only data from important events type: boolean important_only: description: Include only data from important events type: boolean include_process_parents: description: Include parent processes when rendering execution relationships type: boolean /v3/incident/{incident-id}/entity/{entity-id}: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: title: Entity.EntityDetail type: object properties: entity: type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity ips: title: Entity.Device.IPs type: array items: type: string example: - 192.168.1.64 - 192.168.1.163 description: The ip addresses of a device required: - id - type - disposition - investigated - label x-anyOf: - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity ips: title: Entity.Device.IPs type: array items: type: string example: - 192.168.1.64 - 192.168.1.163 description: The ip addresses of a device required: - id - type - disposition - investigated - label - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity names: title: Entity.Device.Names type: array items: type: string example: - link@hyrule.net - link description: The names assocated with a user required: - id - type - disposition - investigated - label - names - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity algorithm: title: Entity.Hash.Algorithm.Enum enum: - - sha256 - sha1 - md5 description: The algorithm used to generate this hash example: md5 type: string value: title: Entity.Hash.Value type: string description: The value of the hash example: c804ecb887cbf798f910a71a15771577 required: - id - type - disposition - investigated - label - algorithm - value - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity name: title: Entity.Attachment.Name type: string description: Name of a device example: Link's PC hashes: title: Entity.Attachment.Hashes type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the hashes associated with this attachment example: - 636712a3-2705-4bdb-9639-de8761b57b2b - 20c93a73-cc3c-4012-b807-38a49ec1bfd7 required: - id - type - disposition - investigated - label - name - hashes - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity from: title: Entity.Email.From type: string example: 86518fc4-9401-4ebf-be28-730d2cb91762 description: The Entity ID of the user who sent the email to: title: Entity.Email.To type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the users who received the email example: - 759201b1-bfa2-4e6c-9a66-858e470d86d4 - 06f7cf3a-deb5-4dc6-b08e-b0174d665c10 attachment: title: Entity.Email.Attachment type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the email attachments example: - 61d9d2b4-b0f4-46f6-a309-35651ddcd445 - c2977a99-e0d4-4dc0-abe0-1653bf01e543 required: - id - type - disposition - investigated - label - from - to - attachment activities: type: array items: type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. sighting: title: Activity.Base.Sighting type: array items: type: string example: string description: String with at most 1024 characters. description: The sightings associated with the activity example: - 45ed81d9-8e32-46e2-b604-7cf19114dd91 - d757f328-827d-4fb0-8729-b63f77289d0a observed_times: title: Activity.Base.ObservedTimes type: array items: type: string example: string description: String with at most 1024 characters. description: The observed_times associated with the activity example: - '1727117998000' edges: title: Activity.Base.Edges type: array items: title: Activity.Base.Edges.Edge type: object properties: source: title: Activity.Base.Edges.Edge.Source type: string example: 0617f00c-bcee-4e8b-b18d-3511809c754d description: The Entity ID of the first entity of the relationship related: title: Activity.Base.Edges.Edge.Related type: string example: d126f865-c0eb-4d9f-9818-260263b3a77f description: The Entity ID of the second entity of the relationship relation: title: Activity.Base.Edges.Edge.Relation type: string example: Connected To description: The name of the relationship required: - source - related - relation description: A relationship representing a discrete part of an activity description: The relationships associated with the activity email_message: title: Activity.EmailSent.EmailMessage type: string example: 57c4a6c1-bab0-4994-a652-a4622b4fdc79 description: The Entity ID of the sent message connection_info: title: Activity.EmailSent.ConnectionInfo type: object properties: from_device: title: Activity.EmailSent.ConnectionInfo.FromDevice type: string example: d5fa73df-c9f9-4444-bcbe-7b7ea8d8dfd8 description: The device that relayed the message to the receiving device to_device: title: Activity.EmailSent.ConnectionInfo.ToDevice type: array items: type: string example: string description: String with at most 1024 characters. description: The devices that received the message example: - ef8227ed-95aa-4338-b888-0869ecace0e9 - 71dd40ec-a367-4aa9-92ac-e97ff2550428 required: - from_device - to_device description: The connection information for the sent email required: - id - sighting - observed_times - edges - email_message - connection_info x-anyOf: - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. sighting: title: Activity.Base.Sighting type: array items: type: string example: string description: String with at most 1024 characters. description: The sightings associated with the activity example: - 45ed81d9-8e32-46e2-b604-7cf19114dd91 - d757f328-827d-4fb0-8729-b63f77289d0a observed_times: title: Activity.Base.ObservedTimes type: array items: type: string example: string description: String with at most 1024 characters. description: The observed_times associated with the activity example: - '1727117998000' edges: title: Activity.Base.Edges type: array items: title: Activity.Base.Edges.Edge type: object properties: source: title: Activity.Base.Edges.Edge.Source type: string example: 0617f00c-bcee-4e8b-b18d-3511809c754d description: The Entity ID of the first entity of the relationship related: title: Activity.Base.Edges.Edge.Related type: string example: d126f865-c0eb-4d9f-9818-260263b3a77f description: The Entity ID of the second entity of the relationship relation: title: Activity.Base.Edges.Edge.Relation type: string example: Connected To description: The name of the relationship required: - source - related - relation description: A relationship representing a discrete part of an activity description: The relationships associated with the activity email_message: title: Activity.EmailSent.EmailMessage type: string example: 57c4a6c1-bab0-4994-a652-a4622b4fdc79 description: The Entity ID of the sent message connection_info: title: Activity.EmailSent.ConnectionInfo type: object properties: from_device: title: Activity.EmailSent.ConnectionInfo.FromDevice type: string example: d5fa73df-c9f9-4444-bcbe-7b7ea8d8dfd8 description: The device that relayed the message to the receiving device to_device: title: Activity.EmailSent.ConnectionInfo.ToDevice type: array items: type: string example: string description: String with at most 1024 characters. description: The devices that received the message example: - ef8227ed-95aa-4338-b888-0869ecace0e9 - 71dd40ec-a367-4aa9-92ac-e97ff2550428 required: - from_device - to_device description: The connection information for the sent email required: - id - sighting - observed_times - edges - email_message - connection_info required: - entity - activities description: The details for an entity including it's activities application/transit+msgpack: schema: title: Entity.EntityDetail type: object properties: entity: type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity ips: title: Entity.Device.IPs type: array items: type: string example: - 192.168.1.64 - 192.168.1.163 description: The ip addresses of a device required: - id - type - disposition - investigated - label x-anyOf: - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity ips: title: Entity.Device.IPs type: array items: type: string example: - 192.168.1.64 - 192.168.1.163 description: The ip addresses of a device required: - id - type - disposition - investigated - label - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity names: title: Entity.Device.Names type: array items: type: string example: - link@hyrule.net - link description: The names assocated with a user required: - id - type - disposition - investigated - label - names - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity algorithm: title: Entity.Hash.Algorithm.Enum enum: - - sha256 - sha1 - md5 description: The algorithm used to generate this hash example: md5 type: string value: title: Entity.Hash.Value type: string description: The value of the hash example: c804ecb887cbf798f910a71a15771577 required: - id - type - disposition - investigated - label - algorithm - value - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity name: title: Entity.Attachment.Name type: string description: Name of a device example: Link's PC hashes: title: Entity.Attachment.Hashes type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the hashes associated with this attachment example: - 636712a3-2705-4bdb-9639-de8761b57b2b - 20c93a73-cc3c-4012-b807-38a49ec1bfd7 required: - id - type - disposition - investigated - label - name - hashes - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity from: title: Entity.Email.From type: string example: 86518fc4-9401-4ebf-be28-730d2cb91762 description: The Entity ID of the user who sent the email to: title: Entity.Email.To type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the users who received the email example: - 759201b1-bfa2-4e6c-9a66-858e470d86d4 - 06f7cf3a-deb5-4dc6-b08e-b0174d665c10 attachment: title: Entity.Email.Attachment type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the email attachments example: - 61d9d2b4-b0f4-46f6-a309-35651ddcd445 - c2977a99-e0d4-4dc0-abe0-1653bf01e543 required: - id - type - disposition - investigated - label - from - to - attachment activities: type: array items: type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. sighting: title: Activity.Base.Sighting type: array items: type: string example: string description: String with at most 1024 characters. description: The sightings associated with the activity example: - 45ed81d9-8e32-46e2-b604-7cf19114dd91 - d757f328-827d-4fb0-8729-b63f77289d0a observed_times: title: Activity.Base.ObservedTimes type: array items: type: string example: string description: String with at most 1024 characters. description: The observed_times associated with the activity example: - '1727117998000' edges: title: Activity.Base.Edges type: array items: title: Activity.Base.Edges.Edge type: object properties: source: title: Activity.Base.Edges.Edge.Source type: string example: 0617f00c-bcee-4e8b-b18d-3511809c754d description: The Entity ID of the first entity of the relationship related: title: Activity.Base.Edges.Edge.Related type: string example: d126f865-c0eb-4d9f-9818-260263b3a77f description: The Entity ID of the second entity of the relationship relation: title: Activity.Base.Edges.Edge.Relation type: string example: Connected To description: The name of the relationship required: - source - related - relation description: A relationship representing a discrete part of an activity description: The relationships associated with the activity email_message: title: Activity.EmailSent.EmailMessage type: string example: 57c4a6c1-bab0-4994-a652-a4622b4fdc79 description: The Entity ID of the sent message connection_info: title: Activity.EmailSent.ConnectionInfo type: object properties: from_device: title: Activity.EmailSent.ConnectionInfo.FromDevice type: string example: d5fa73df-c9f9-4444-bcbe-7b7ea8d8dfd8 description: The device that relayed the message to the receiving device to_device: title: Activity.EmailSent.ConnectionInfo.ToDevice type: array items: type: string example: string description: String with at most 1024 characters. description: The devices that received the message example: - ef8227ed-95aa-4338-b888-0869ecace0e9 - 71dd40ec-a367-4aa9-92ac-e97ff2550428 required: - from_device - to_device description: The connection information for the sent email required: - id - sighting - observed_times - edges - email_message - connection_info x-anyOf: - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. sighting: title: Activity.Base.Sighting type: array items: type: string example: string description: String with at most 1024 characters. description: The sightings associated with the activity example: - 45ed81d9-8e32-46e2-b604-7cf19114dd91 - d757f328-827d-4fb0-8729-b63f77289d0a observed_times: title: Activity.Base.ObservedTimes type: array items: type: string example: string description: String with at most 1024 characters. description: The observed_times associated with the activity example: - '1727117998000' edges: title: Activity.Base.Edges type: array items: title: Activity.Base.Edges.Edge type: object properties: source: title: Activity.Base.Edges.Edge.Source type: string example: 0617f00c-bcee-4e8b-b18d-3511809c754d description: The Entity ID of the first entity of the relationship related: title: Activity.Base.Edges.Edge.Related type: string example: d126f865-c0eb-4d9f-9818-260263b3a77f description: The Entity ID of the second entity of the relationship relation: title: Activity.Base.Edges.Edge.Relation type: string example: Connected To description: The name of the relationship required: - source - related - relation description: A relationship representing a discrete part of an activity description: The relationships associated with the activity email_message: title: Activity.EmailSent.EmailMessage type: string example: 57c4a6c1-bab0-4994-a652-a4622b4fdc79 description: The Entity ID of the sent message connection_info: title: Activity.EmailSent.ConnectionInfo type: object properties: from_device: title: Activity.EmailSent.ConnectionInfo.FromDevice type: string example: d5fa73df-c9f9-4444-bcbe-7b7ea8d8dfd8 description: The device that relayed the message to the receiving device to_device: title: Activity.EmailSent.ConnectionInfo.ToDevice type: array items: type: string example: string description: String with at most 1024 characters. description: The devices that received the message example: - ef8227ed-95aa-4338-b888-0869ecace0e9 - 71dd40ec-a367-4aa9-92ac-e97ff2550428 required: - from_device - to_device description: The connection information for the sent email required: - id - sighting - observed_times - edges - email_message - connection_info required: - entity - activities description: The details for an entity including it's activities application/transit+json: schema: title: Entity.EntityDetail type: object properties: entity: type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity ips: title: Entity.Device.IPs type: array items: type: string example: - 192.168.1.64 - 192.168.1.163 description: The ip addresses of a device required: - id - type - disposition - investigated - label x-anyOf: - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity ips: title: Entity.Device.IPs type: array items: type: string example: - 192.168.1.64 - 192.168.1.163 description: The ip addresses of a device required: - id - type - disposition - investigated - label - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity names: title: Entity.Device.Names type: array items: type: string example: - link@hyrule.net - link description: The names assocated with a user required: - id - type - disposition - investigated - label - names - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity algorithm: title: Entity.Hash.Algorithm.Enum enum: - - sha256 - sha1 - md5 description: The algorithm used to generate this hash example: md5 type: string value: title: Entity.Hash.Value type: string description: The value of the hash example: c804ecb887cbf798f910a71a15771577 required: - id - type - disposition - investigated - label - algorithm - value - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity name: title: Entity.Attachment.Name type: string description: Name of a device example: Link's PC hashes: title: Entity.Attachment.Hashes type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the hashes associated with this attachment example: - 636712a3-2705-4bdb-9639-de8761b57b2b - 20c93a73-cc3c-4012-b807-38a49ec1bfd7 required: - id - type - disposition - investigated - label - name - hashes - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity from: title: Entity.Email.From type: string example: 86518fc4-9401-4ebf-be28-730d2cb91762 description: The Entity ID of the user who sent the email to: title: Entity.Email.To type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the users who received the email example: - 759201b1-bfa2-4e6c-9a66-858e470d86d4 - 06f7cf3a-deb5-4dc6-b08e-b0174d665c10 attachment: title: Entity.Email.Attachment type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the email attachments example: - 61d9d2b4-b0f4-46f6-a309-35651ddcd445 - c2977a99-e0d4-4dc0-abe0-1653bf01e543 required: - id - type - disposition - investigated - label - from - to - attachment activities: type: array items: type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. sighting: title: Activity.Base.Sighting type: array items: type: string example: string description: String with at most 1024 characters. description: The sightings associated with the activity example: - 45ed81d9-8e32-46e2-b604-7cf19114dd91 - d757f328-827d-4fb0-8729-b63f77289d0a observed_times: title: Activity.Base.ObservedTimes type: array items: type: string example: string description: String with at most 1024 characters. description: The observed_times associated with the activity example: - '1727117998000' edges: title: Activity.Base.Edges type: array items: title: Activity.Base.Edges.Edge type: object properties: source: title: Activity.Base.Edges.Edge.Source type: string example: 0617f00c-bcee-4e8b-b18d-3511809c754d description: The Entity ID of the first entity of the relationship related: title: Activity.Base.Edges.Edge.Related type: string example: d126f865-c0eb-4d9f-9818-260263b3a77f description: The Entity ID of the second entity of the relationship relation: title: Activity.Base.Edges.Edge.Relation type: string example: Connected To description: The name of the relationship required: - source - related - relation description: A relationship representing a discrete part of an activity description: The relationships associated with the activity email_message: title: Activity.EmailSent.EmailMessage type: string example: 57c4a6c1-bab0-4994-a652-a4622b4fdc79 description: The Entity ID of the sent message connection_info: title: Activity.EmailSent.ConnectionInfo type: object properties: from_device: title: Activity.EmailSent.ConnectionInfo.FromDevice type: string example: d5fa73df-c9f9-4444-bcbe-7b7ea8d8dfd8 description: The device that relayed the message to the receiving device to_device: title: Activity.EmailSent.ConnectionInfo.ToDevice type: array items: type: string example: string description: String with at most 1024 characters. description: The devices that received the message example: - ef8227ed-95aa-4338-b888-0869ecace0e9 - 71dd40ec-a367-4aa9-92ac-e97ff2550428 required: - from_device - to_device description: The connection information for the sent email required: - id - sighting - observed_times - edges - email_message - connection_info x-anyOf: - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. sighting: title: Activity.Base.Sighting type: array items: type: string example: string description: String with at most 1024 characters. description: The sightings associated with the activity example: - 45ed81d9-8e32-46e2-b604-7cf19114dd91 - d757f328-827d-4fb0-8729-b63f77289d0a observed_times: title: Activity.Base.ObservedTimes type: array items: type: string example: string description: String with at most 1024 characters. description: The observed_times associated with the activity example: - '1727117998000' edges: title: Activity.Base.Edges type: array items: title: Activity.Base.Edges.Edge type: object properties: source: title: Activity.Base.Edges.Edge.Source type: string example: 0617f00c-bcee-4e8b-b18d-3511809c754d description: The Entity ID of the first entity of the relationship related: title: Activity.Base.Edges.Edge.Related type: string example: d126f865-c0eb-4d9f-9818-260263b3a77f description: The Entity ID of the second entity of the relationship relation: title: Activity.Base.Edges.Edge.Relation type: string example: Connected To description: The name of the relationship required: - source - related - relation description: A relationship representing a discrete part of an activity description: The relationships associated with the activity email_message: title: Activity.EmailSent.EmailMessage type: string example: 57c4a6c1-bab0-4994-a652-a4622b4fdc79 description: The Entity ID of the sent message connection_info: title: Activity.EmailSent.ConnectionInfo type: object properties: from_device: title: Activity.EmailSent.ConnectionInfo.FromDevice type: string example: d5fa73df-c9f9-4444-bcbe-7b7ea8d8dfd8 description: The device that relayed the message to the receiving device to_device: title: Activity.EmailSent.ConnectionInfo.ToDevice type: array items: type: string example: string description: String with at most 1024 characters. description: The devices that received the message example: - ef8227ed-95aa-4338-b888-0869ecace0e9 - 71dd40ec-a367-4aa9-92ac-e97ff2550428 required: - from_device - to_device description: The connection information for the sent email required: - id - sighting - observed_times - edges - email_message - connection_info required: - entity - activities description: The details for an entity including it's activities application/edn: schema: title: Entity.EntityDetail type: object properties: entity: type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity ips: title: Entity.Device.IPs type: array items: type: string example: - 192.168.1.64 - 192.168.1.163 description: The ip addresses of a device required: - id - type - disposition - investigated - label x-anyOf: - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity ips: title: Entity.Device.IPs type: array items: type: string example: - 192.168.1.64 - 192.168.1.163 description: The ip addresses of a device required: - id - type - disposition - investigated - label - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity names: title: Entity.Device.Names type: array items: type: string example: - link@hyrule.net - link description: The names assocated with a user required: - id - type - disposition - investigated - label - names - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity algorithm: title: Entity.Hash.Algorithm.Enum enum: - - sha256 - sha1 - md5 description: The algorithm used to generate this hash example: md5 type: string value: title: Entity.Hash.Value type: string description: The value of the hash example: c804ecb887cbf798f910a71a15771577 required: - id - type - disposition - investigated - label - algorithm - value - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity name: title: Entity.Attachment.Name type: string description: Name of a device example: Link's PC hashes: title: Entity.Attachment.Hashes type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the hashes associated with this attachment example: - 636712a3-2705-4bdb-9639-de8761b57b2b - 20c93a73-cc3c-4012-b807-38a49ec1bfd7 required: - id - type - disposition - investigated - label - name - hashes - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity from: title: Entity.Email.From type: string example: 86518fc4-9401-4ebf-be28-730d2cb91762 description: The Entity ID of the user who sent the email to: title: Entity.Email.To type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the users who received the email example: - 759201b1-bfa2-4e6c-9a66-858e470d86d4 - 06f7cf3a-deb5-4dc6-b08e-b0174d665c10 attachment: title: Entity.Email.Attachment type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the email attachments example: - 61d9d2b4-b0f4-46f6-a309-35651ddcd445 - c2977a99-e0d4-4dc0-abe0-1653bf01e543 required: - id - type - disposition - investigated - label - from - to - attachment activities: type: array items: type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. sighting: title: Activity.Base.Sighting type: array items: type: string example: string description: String with at most 1024 characters. description: The sightings associated with the activity example: - 45ed81d9-8e32-46e2-b604-7cf19114dd91 - d757f328-827d-4fb0-8729-b63f77289d0a observed_times: title: Activity.Base.ObservedTimes type: array items: type: string example: string description: String with at most 1024 characters. description: The observed_times associated with the activity example: - '1727117998000' edges: title: Activity.Base.Edges type: array items: title: Activity.Base.Edges.Edge type: object properties: source: title: Activity.Base.Edges.Edge.Source type: string example: 0617f00c-bcee-4e8b-b18d-3511809c754d description: The Entity ID of the first entity of the relationship related: title: Activity.Base.Edges.Edge.Related type: string example: d126f865-c0eb-4d9f-9818-260263b3a77f description: The Entity ID of the second entity of the relationship relation: title: Activity.Base.Edges.Edge.Relation type: string example: Connected To description: The name of the relationship required: - source - related - relation description: A relationship representing a discrete part of an activity description: The relationships associated with the activity email_message: title: Activity.EmailSent.EmailMessage type: string example: 57c4a6c1-bab0-4994-a652-a4622b4fdc79 description: The Entity ID of the sent message connection_info: title: Activity.EmailSent.ConnectionInfo type: object properties: from_device: title: Activity.EmailSent.ConnectionInfo.FromDevice type: string example: d5fa73df-c9f9-4444-bcbe-7b7ea8d8dfd8 description: The device that relayed the message to the receiving device to_device: title: Activity.EmailSent.ConnectionInfo.ToDevice type: array items: type: string example: string description: String with at most 1024 characters. description: The devices that received the message example: - ef8227ed-95aa-4338-b888-0869ecace0e9 - 71dd40ec-a367-4aa9-92ac-e97ff2550428 required: - from_device - to_device description: The connection information for the sent email required: - id - sighting - observed_times - edges - email_message - connection_info x-anyOf: - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. sighting: title: Activity.Base.Sighting type: array items: type: string example: string description: String with at most 1024 characters. description: The sightings associated with the activity example: - 45ed81d9-8e32-46e2-b604-7cf19114dd91 - d757f328-827d-4fb0-8729-b63f77289d0a observed_times: title: Activity.Base.ObservedTimes type: array items: type: string example: string description: String with at most 1024 characters. description: The observed_times associated with the activity example: - '1727117998000' edges: title: Activity.Base.Edges type: array items: title: Activity.Base.Edges.Edge type: object properties: source: title: Activity.Base.Edges.Edge.Source type: string example: 0617f00c-bcee-4e8b-b18d-3511809c754d description: The Entity ID of the first entity of the relationship related: title: Activity.Base.Edges.Edge.Related type: string example: d126f865-c0eb-4d9f-9818-260263b3a77f description: The Entity ID of the second entity of the relationship relation: title: Activity.Base.Edges.Edge.Relation type: string example: Connected To description: The name of the relationship required: - source - related - relation description: A relationship representing a discrete part of an activity description: The relationships associated with the activity email_message: title: Activity.EmailSent.EmailMessage type: string example: 57c4a6c1-bab0-4994-a652-a4622b4fdc79 description: The Entity ID of the sent message connection_info: title: Activity.EmailSent.ConnectionInfo type: object properties: from_device: title: Activity.EmailSent.ConnectionInfo.FromDevice type: string example: d5fa73df-c9f9-4444-bcbe-7b7ea8d8dfd8 description: The device that relayed the message to the receiving device to_device: title: Activity.EmailSent.ConnectionInfo.ToDevice type: array items: type: string example: string description: String with at most 1024 characters. description: The devices that received the message example: - ef8227ed-95aa-4338-b888-0869ecace0e9 - 71dd40ec-a367-4aa9-92ac-e97ff2550428 required: - from_device - to_device description: The connection information for the sent email required: - id - sighting - observed_times - edges - email_message - connection_info required: - entity - activities description: The details for an entity including it's activities '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: path name: incident-id description: '' required: true schema: type: string - in: path name: entity-id description: '' required: true schema: type: string tags: - v3 summary: Get the attributes of an entity security: - JWT-Bearer: [] - oauth2: [] /v3/investigation/{investigation-id}/events: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: object properties: events: type: array items: type: object properties: compacted_entities: type: array items: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition uniqueItems: true compacted_relations: type: array items: type: object properties: source: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition related: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition relation: type: string origin: type: string required: - source - related - relation uniqueItems: true notability: type: object properties: first_seen_target: type: object properties: label: type: string targets: type: array items: {} uniqueItems: true required: - label - targets severity: type: object properties: label: type: string required: - label mitre-attack: type: object properties: label: type: string required: - label first_seen_indicator: type: object properties: label: type: string indicators: type: array items: {} uniqueItems: true required: - label - indicators original_event: type: object properties: label: type: string required: - label mitreData: type: array items: type: object properties: id: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 value: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 phase_name: type: string enum: - privilege-escalation - exfiltration - defense-evasion - initial-access - collection - execution - impact - reconnaissance - command-and-control - lateral-movement - resource-development - credential-access - discovery - persistence priority: type: integer enum: - 6 - 12 - 7 - 3 - 10 - 4 - 13 - 1 - 11 - 9 - 2 - 8 - 8 - 5 url: type: string enum: - https://attack.mitre.org/tactics/TA0004/ - https://attack.mitre.org/tactics/TA0010/ - https://attack.mitre.org/tactics/TA0005/ - https://attack.mitre.org/tactics/TA0001/ - https://attack.mitre.org/tactics/TA0009/ - https://attack.mitre.org/tactics/TA0002/ - https://attack.mitre.org/tactics/TA0040/ - https://attack.mitre.org/tactics/TA0043/ - https://attack.mitre.org/tactics/TA0011/ - https://attack.mitre.org/tactics/TA0008/ - https://attack.mitre.org/tactics/TA0042/ - https://attack.mitre.org/tactics/TA0006/ - https://attack.mitre.org/tactics/TA0007/ - https://attack.mitre.org/tactics/TA0003/ title: type: string enum: - Privilege Escalation - Exfiltration - Defense Evasion - Initial Access - Collection - Execution - Impact - Reconnaissance - Command and Control - Lateral Movement - Resource Development - Credential Access - Discovery - Persistence required: - id - value - phase_name - priority - url - title uniqueItems: true notable: type: boolean original: type: boolean indicators: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - indicator example: indicator description: The fixed value indicator schema_version: type: string example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: - string - 'null' example: string description: A description of object, which may be detailed. short_description: type: - string - 'null' example: string description: A single line, short summary of the object. source: type: - string - 'null' example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: - string - 'null' example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time range during which this Indicator is considered valid. producer: type: string example: string description: String with at most 1024 characters. severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical negate: type: boolean example: true description: Specifies the absence of the pattern. indicator_type: type: array items: type: string enum: - Anonymization - C2 - Compromised PKI Certificate - Domain Watchlist - Exfiltration - File Hash Watchlist - Host Characteristics - IMEI Watchlist - IMSI Watchlist - IP Watchlist - Login Name - Malicious E-mail - Malware Artifacts - Private Threat Feed - URL Watchlist example: Anonymization example: - Anonymization description: Specifies the type or types for this Indicator. tags: type: - array - 'null' items: type: string example: - string description: Descriptors for this indicator. composite_indicator_expression: type: object properties: operator: type: string enum: - and - not - or example: and indicator_ids: type: array items: type: string example: string description: A URI leading to an indicator. example: - string required: - operator - indicator_ids example: operator: and indicator_ids: - string likely_impact: type: string example: string description: Likely potential impact within the relevant context if this Indicator were to occur. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: level of confidence held in the accuracy of this Indicator. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: Relevant kill chain phases indicated by this Indicator. test_mechanisms: type: array items: type: string example: string description: String with at most 2048 characters. example: - string description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator. specification: type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. x-anyOf: - type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. - type: object properties: type: type: string enum: - ThreatBrain example: ThreatBrain query: type: string example: string variables: type: array items: type: string example: string example: - string required: - type - variables example: type: ThreatBrain query: string variables: - string description: An indicator which runs in threatbrain... - type: object properties: type: type: string enum: - Snort example: Snort snort_sig: type: string example: string required: - type - snort_sig example: type: Snort snort_sig: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - SIOC example: SIOC SIOC: type: string example: string required: - type - SIOC example: type: SIOC SIOC: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - OpenIOC example: OpenIOC open_IOC: type: string example: string required: - type - open_IOC example: type: OpenIOC open_IOC: string description: An indicator which contains an XML blob of an openIOC indicator. value: title: Event.Indicator.Value type: string example: W32.AdditionVariableCommandObfuscation.ioc description: The canonical label for an indicator. required: - id - producer - value example: description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: 'An indicator is a test, or a collection of judgements that define criteria for identifying the activity, or presence of malware, or other unwanted software. We follow the [STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/) closely, with the exception of not including observables within the indicator, and preferring a _specification_ object encoded in JSON as opposed to an opaque _implementation_ block. Additional, you will want to either define judgements against Observables that are linked to this indicator, with the ID in the _indicators_ field of those Judgements, or you can provide a _specification_ value.' investigationId: type: - string - 'null' investigationShortDescription: type: - string - 'null' investigationSource: type: - string - 'null' confidence: type: string enum: - High - Info - Low - Medium - None - Unknown count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 id: type: string x-anyOf: - type: string - type: string format: uuid observed_time: type: object properties: start_time: type: string end_time: type: - string - 'null' required: - start_time type: type: string enum: - sighting context: {} data: type: object properties: columns: type: array items: type: object properties: name: type: string type: type: string enum: - integer - markdown - number - observable - string - url description: type: - string - 'null' required: type: boolean short_description: type: - string - 'null' required: - name - type rows: type: array items: {} row_count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - columns - rows external_ids: type: array items: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name internal: type: boolean language: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 resolution: type: string enum: - allowed - blocked - contained - detected sensor: type: string sensor_coordinates: type: object properties: observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value os: type: string type: type: string required: - observables - type severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_description: type: string source: type: string source_uri: type: string timestamp: type: string title: type: - string - 'null' tactics_and_techniques: type: array items: title: Mitre tactics and Techniques type: object properties: id: title: MitreID type: string example: TA0003 description: MITRE ATT&CK ID external_id: title: MitreExternalId type: string example: TA0003 description: MITRE ATT&CK ID title: title: MitreTitle type: string example: Persistence short_description: title: MitreShortDescription type: - string - 'null' example: Persistence description: title: MitreDescription type: string example: 'The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.' score: title: MitreScore type: - integer - 'null' format: int64 minimum: 1 maximum: 1000 example: 44 source_url: title: MitreSourceURL type: - string - 'null' example: https://attack.mitre.org/techniques/TA0003 description: The source url for this tactic or technique mitre_type: type: string enum: - tactic - technique - subtechnique required: - id - external_id - title - short_description - description - score - source_url - mitre_type description: A MITRE object from https://attack.mitre.org/ tlp: type: string enum: - amber - green - red - white required: - notable - original - confidence - count - id - observed_time - type required: - events application/transit+msgpack: schema: type: object properties: events: type: array items: type: object properties: compacted_entities: type: array items: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition uniqueItems: true compacted_relations: type: array items: type: object properties: source: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition related: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition relation: type: string origin: type: string required: - source - related - relation uniqueItems: true notability: type: object properties: first_seen_target: type: object properties: label: type: string targets: type: array items: {} uniqueItems: true required: - label - targets severity: type: object properties: label: type: string required: - label mitre-attack: type: object properties: label: type: string required: - label first_seen_indicator: type: object properties: label: type: string indicators: type: array items: {} uniqueItems: true required: - label - indicators original_event: type: object properties: label: type: string required: - label mitreData: type: array items: type: object properties: id: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 value: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 phase_name: type: string enum: - privilege-escalation - exfiltration - defense-evasion - initial-access - collection - execution - impact - reconnaissance - command-and-control - lateral-movement - resource-development - credential-access - discovery - persistence priority: type: integer enum: - 6 - 12 - 7 - 3 - 10 - 4 - 13 - 1 - 11 - 9 - 2 - 8 - 8 - 5 url: type: string enum: - https://attack.mitre.org/tactics/TA0004/ - https://attack.mitre.org/tactics/TA0010/ - https://attack.mitre.org/tactics/TA0005/ - https://attack.mitre.org/tactics/TA0001/ - https://attack.mitre.org/tactics/TA0009/ - https://attack.mitre.org/tactics/TA0002/ - https://attack.mitre.org/tactics/TA0040/ - https://attack.mitre.org/tactics/TA0043/ - https://attack.mitre.org/tactics/TA0011/ - https://attack.mitre.org/tactics/TA0008/ - https://attack.mitre.org/tactics/TA0042/ - https://attack.mitre.org/tactics/TA0006/ - https://attack.mitre.org/tactics/TA0007/ - https://attack.mitre.org/tactics/TA0003/ title: type: string enum: - Privilege Escalation - Exfiltration - Defense Evasion - Initial Access - Collection - Execution - Impact - Reconnaissance - Command and Control - Lateral Movement - Resource Development - Credential Access - Discovery - Persistence required: - id - value - phase_name - priority - url - title uniqueItems: true notable: type: boolean original: type: boolean indicators: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - indicator example: indicator description: The fixed value indicator schema_version: type: string example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: - string - 'null' example: string description: A description of object, which may be detailed. short_description: type: - string - 'null' example: string description: A single line, short summary of the object. source: type: - string - 'null' example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: - string - 'null' example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time range during which this Indicator is considered valid. producer: type: string example: string description: String with at most 1024 characters. severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical negate: type: boolean example: true description: Specifies the absence of the pattern. indicator_type: type: array items: type: string enum: - Anonymization - C2 - Compromised PKI Certificate - Domain Watchlist - Exfiltration - File Hash Watchlist - Host Characteristics - IMEI Watchlist - IMSI Watchlist - IP Watchlist - Login Name - Malicious E-mail - Malware Artifacts - Private Threat Feed - URL Watchlist example: Anonymization example: - Anonymization description: Specifies the type or types for this Indicator. tags: type: - array - 'null' items: type: string example: - string description: Descriptors for this indicator. composite_indicator_expression: type: object properties: operator: type: string enum: - and - not - or example: and indicator_ids: type: array items: type: string example: string description: A URI leading to an indicator. example: - string required: - operator - indicator_ids example: operator: and indicator_ids: - string likely_impact: type: string example: string description: Likely potential impact within the relevant context if this Indicator were to occur. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: level of confidence held in the accuracy of this Indicator. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: Relevant kill chain phases indicated by this Indicator. test_mechanisms: type: array items: type: string example: string description: String with at most 2048 characters. example: - string description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator. specification: type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. x-anyOf: - type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. - type: object properties: type: type: string enum: - ThreatBrain example: ThreatBrain query: type: string example: string variables: type: array items: type: string example: string example: - string required: - type - variables example: type: ThreatBrain query: string variables: - string description: An indicator which runs in threatbrain... - type: object properties: type: type: string enum: - Snort example: Snort snort_sig: type: string example: string required: - type - snort_sig example: type: Snort snort_sig: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - SIOC example: SIOC SIOC: type: string example: string required: - type - SIOC example: type: SIOC SIOC: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - OpenIOC example: OpenIOC open_IOC: type: string example: string required: - type - open_IOC example: type: OpenIOC open_IOC: string description: An indicator which contains an XML blob of an openIOC indicator. value: title: Event.Indicator.Value type: string example: W32.AdditionVariableCommandObfuscation.ioc description: The canonical label for an indicator. required: - id - producer - value example: description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: 'An indicator is a test, or a collection of judgements that define criteria for identifying the activity, or presence of malware, or other unwanted software. We follow the [STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/) closely, with the exception of not including observables within the indicator, and preferring a _specification_ object encoded in JSON as opposed to an opaque _implementation_ block. Additional, you will want to either define judgements against Observables that are linked to this indicator, with the ID in the _indicators_ field of those Judgements, or you can provide a _specification_ value.' investigationId: type: - string - 'null' investigationShortDescription: type: - string - 'null' investigationSource: type: - string - 'null' confidence: type: string enum: - High - Info - Low - Medium - None - Unknown count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 id: type: string x-anyOf: - type: string - type: string format: uuid observed_time: type: object properties: start_time: type: string end_time: type: - string - 'null' required: - start_time type: type: string enum: - sighting context: {} data: type: object properties: columns: type: array items: type: object properties: name: type: string type: type: string enum: - integer - markdown - number - observable - string - url description: type: - string - 'null' required: type: boolean short_description: type: - string - 'null' required: - name - type rows: type: array items: {} row_count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - columns - rows external_ids: type: array items: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name internal: type: boolean language: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 resolution: type: string enum: - allowed - blocked - contained - detected sensor: type: string sensor_coordinates: type: object properties: observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value os: type: string type: type: string required: - observables - type severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_description: type: string source: type: string source_uri: type: string timestamp: type: string title: type: - string - 'null' tactics_and_techniques: type: array items: title: Mitre tactics and Techniques type: object properties: id: title: MitreID type: string example: TA0003 description: MITRE ATT&CK ID external_id: title: MitreExternalId type: string example: TA0003 description: MITRE ATT&CK ID title: title: MitreTitle type: string example: Persistence short_description: title: MitreShortDescription type: - string - 'null' example: Persistence description: title: MitreDescription type: string example: 'The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.' score: title: MitreScore type: - integer - 'null' format: int64 minimum: 1 maximum: 1000 example: 44 source_url: title: MitreSourceURL type: - string - 'null' example: https://attack.mitre.org/techniques/TA0003 description: The source url for this tactic or technique mitre_type: type: string enum: - tactic - technique - subtechnique required: - id - external_id - title - short_description - description - score - source_url - mitre_type description: A MITRE object from https://attack.mitre.org/ tlp: type: string enum: - amber - green - red - white required: - notable - original - confidence - count - id - observed_time - type required: - events application/transit+json: schema: type: object properties: events: type: array items: type: object properties: compacted_entities: type: array items: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition uniqueItems: true compacted_relations: type: array items: type: object properties: source: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition related: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition relation: type: string origin: type: string required: - source - related - relation uniqueItems: true notability: type: object properties: first_seen_target: type: object properties: label: type: string targets: type: array items: {} uniqueItems: true required: - label - targets severity: type: object properties: label: type: string required: - label mitre-attack: type: object properties: label: type: string required: - label first_seen_indicator: type: object properties: label: type: string indicators: type: array items: {} uniqueItems: true required: - label - indicators original_event: type: object properties: label: type: string required: - label mitreData: type: array items: type: object properties: id: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 value: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 phase_name: type: string enum: - privilege-escalation - exfiltration - defense-evasion - initial-access - collection - execution - impact - reconnaissance - command-and-control - lateral-movement - resource-development - credential-access - discovery - persistence priority: type: integer enum: - 6 - 12 - 7 - 3 - 10 - 4 - 13 - 1 - 11 - 9 - 2 - 8 - 8 - 5 url: type: string enum: - https://attack.mitre.org/tactics/TA0004/ - https://attack.mitre.org/tactics/TA0010/ - https://attack.mitre.org/tactics/TA0005/ - https://attack.mitre.org/tactics/TA0001/ - https://attack.mitre.org/tactics/TA0009/ - https://attack.mitre.org/tactics/TA0002/ - https://attack.mitre.org/tactics/TA0040/ - https://attack.mitre.org/tactics/TA0043/ - https://attack.mitre.org/tactics/TA0011/ - https://attack.mitre.org/tactics/TA0008/ - https://attack.mitre.org/tactics/TA0042/ - https://attack.mitre.org/tactics/TA0006/ - https://attack.mitre.org/tactics/TA0007/ - https://attack.mitre.org/tactics/TA0003/ title: type: string enum: - Privilege Escalation - Exfiltration - Defense Evasion - Initial Access - Collection - Execution - Impact - Reconnaissance - Command and Control - Lateral Movement - Resource Development - Credential Access - Discovery - Persistence required: - id - value - phase_name - priority - url - title uniqueItems: true notable: type: boolean original: type: boolean indicators: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - indicator example: indicator description: The fixed value indicator schema_version: type: string example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: - string - 'null' example: string description: A description of object, which may be detailed. short_description: type: - string - 'null' example: string description: A single line, short summary of the object. source: type: - string - 'null' example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: - string - 'null' example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time range during which this Indicator is considered valid. producer: type: string example: string description: String with at most 1024 characters. severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical negate: type: boolean example: true description: Specifies the absence of the pattern. indicator_type: type: array items: type: string enum: - Anonymization - C2 - Compromised PKI Certificate - Domain Watchlist - Exfiltration - File Hash Watchlist - Host Characteristics - IMEI Watchlist - IMSI Watchlist - IP Watchlist - Login Name - Malicious E-mail - Malware Artifacts - Private Threat Feed - URL Watchlist example: Anonymization example: - Anonymization description: Specifies the type or types for this Indicator. tags: type: - array - 'null' items: type: string example: - string description: Descriptors for this indicator. composite_indicator_expression: type: object properties: operator: type: string enum: - and - not - or example: and indicator_ids: type: array items: type: string example: string description: A URI leading to an indicator. example: - string required: - operator - indicator_ids example: operator: and indicator_ids: - string likely_impact: type: string example: string description: Likely potential impact within the relevant context if this Indicator were to occur. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: level of confidence held in the accuracy of this Indicator. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: Relevant kill chain phases indicated by this Indicator. test_mechanisms: type: array items: type: string example: string description: String with at most 2048 characters. example: - string description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator. specification: type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. x-anyOf: - type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. - type: object properties: type: type: string enum: - ThreatBrain example: ThreatBrain query: type: string example: string variables: type: array items: type: string example: string example: - string required: - type - variables example: type: ThreatBrain query: string variables: - string description: An indicator which runs in threatbrain... - type: object properties: type: type: string enum: - Snort example: Snort snort_sig: type: string example: string required: - type - snort_sig example: type: Snort snort_sig: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - SIOC example: SIOC SIOC: type: string example: string required: - type - SIOC example: type: SIOC SIOC: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - OpenIOC example: OpenIOC open_IOC: type: string example: string required: - type - open_IOC example: type: OpenIOC open_IOC: string description: An indicator which contains an XML blob of an openIOC indicator. value: title: Event.Indicator.Value type: string example: W32.AdditionVariableCommandObfuscation.ioc description: The canonical label for an indicator. required: - id - producer - value example: description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: 'An indicator is a test, or a collection of judgements that define criteria for identifying the activity, or presence of malware, or other unwanted software. We follow the [STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/) closely, with the exception of not including observables within the indicator, and preferring a _specification_ object encoded in JSON as opposed to an opaque _implementation_ block. Additional, you will want to either define judgements against Observables that are linked to this indicator, with the ID in the _indicators_ field of those Judgements, or you can provide a _specification_ value.' investigationId: type: - string - 'null' investigationShortDescription: type: - string - 'null' investigationSource: type: - string - 'null' confidence: type: string enum: - High - Info - Low - Medium - None - Unknown count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 id: type: string x-anyOf: - type: string - type: string format: uuid observed_time: type: object properties: start_time: type: string end_time: type: - string - 'null' required: - start_time type: type: string enum: - sighting context: {} data: type: object properties: columns: type: array items: type: object properties: name: type: string type: type: string enum: - integer - markdown - number - observable - string - url description: type: - string - 'null' required: type: boolean short_description: type: - string - 'null' required: - name - type rows: type: array items: {} row_count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - columns - rows external_ids: type: array items: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name internal: type: boolean language: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 resolution: type: string enum: - allowed - blocked - contained - detected sensor: type: string sensor_coordinates: type: object properties: observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value os: type: string type: type: string required: - observables - type severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_description: type: string source: type: string source_uri: type: string timestamp: type: string title: type: - string - 'null' tactics_and_techniques: type: array items: title: Mitre tactics and Techniques type: object properties: id: title: MitreID type: string example: TA0003 description: MITRE ATT&CK ID external_id: title: MitreExternalId type: string example: TA0003 description: MITRE ATT&CK ID title: title: MitreTitle type: string example: Persistence short_description: title: MitreShortDescription type: - string - 'null' example: Persistence description: title: MitreDescription type: string example: 'The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.' score: title: MitreScore type: - integer - 'null' format: int64 minimum: 1 maximum: 1000 example: 44 source_url: title: MitreSourceURL type: - string - 'null' example: https://attack.mitre.org/techniques/TA0003 description: The source url for this tactic or technique mitre_type: type: string enum: - tactic - technique - subtechnique required: - id - external_id - title - short_description - description - score - source_url - mitre_type description: A MITRE object from https://attack.mitre.org/ tlp: type: string enum: - amber - green - red - white required: - notable - original - confidence - count - id - observed_time - type required: - events application/edn: schema: type: object properties: events: type: array items: type: object properties: compacted_entities: type: array items: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition uniqueItems: true compacted_relations: type: array items: type: object properties: source: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition related: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition relation: type: string origin: type: string required: - source - related - relation uniqueItems: true notability: type: object properties: first_seen_target: type: object properties: label: type: string targets: type: array items: {} uniqueItems: true required: - label - targets severity: type: object properties: label: type: string required: - label mitre-attack: type: object properties: label: type: string required: - label first_seen_indicator: type: object properties: label: type: string indicators: type: array items: {} uniqueItems: true required: - label - indicators original_event: type: object properties: label: type: string required: - label mitreData: type: array items: type: object properties: id: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 value: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 phase_name: type: string enum: - privilege-escalation - exfiltration - defense-evasion - initial-access - collection - execution - impact - reconnaissance - command-and-control - lateral-movement - resource-development - credential-access - discovery - persistence priority: type: integer enum: - 6 - 12 - 7 - 3 - 10 - 4 - 13 - 1 - 11 - 9 - 2 - 8 - 8 - 5 url: type: string enum: - https://attack.mitre.org/tactics/TA0004/ - https://attack.mitre.org/tactics/TA0010/ - https://attack.mitre.org/tactics/TA0005/ - https://attack.mitre.org/tactics/TA0001/ - https://attack.mitre.org/tactics/TA0009/ - https://attack.mitre.org/tactics/TA0002/ - https://attack.mitre.org/tactics/TA0040/ - https://attack.mitre.org/tactics/TA0043/ - https://attack.mitre.org/tactics/TA0011/ - https://attack.mitre.org/tactics/TA0008/ - https://attack.mitre.org/tactics/TA0042/ - https://attack.mitre.org/tactics/TA0006/ - https://attack.mitre.org/tactics/TA0007/ - https://attack.mitre.org/tactics/TA0003/ title: type: string enum: - Privilege Escalation - Exfiltration - Defense Evasion - Initial Access - Collection - Execution - Impact - Reconnaissance - Command and Control - Lateral Movement - Resource Development - Credential Access - Discovery - Persistence required: - id - value - phase_name - priority - url - title uniqueItems: true notable: type: boolean original: type: boolean indicators: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - indicator example: indicator description: The fixed value indicator schema_version: type: string example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: - string - 'null' example: string description: A description of object, which may be detailed. short_description: type: - string - 'null' example: string description: A single line, short summary of the object. source: type: - string - 'null' example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: - string - 'null' example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time range during which this Indicator is considered valid. producer: type: string example: string description: String with at most 1024 characters. severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical negate: type: boolean example: true description: Specifies the absence of the pattern. indicator_type: type: array items: type: string enum: - Anonymization - C2 - Compromised PKI Certificate - Domain Watchlist - Exfiltration - File Hash Watchlist - Host Characteristics - IMEI Watchlist - IMSI Watchlist - IP Watchlist - Login Name - Malicious E-mail - Malware Artifacts - Private Threat Feed - URL Watchlist example: Anonymization example: - Anonymization description: Specifies the type or types for this Indicator. tags: type: - array - 'null' items: type: string example: - string description: Descriptors for this indicator. composite_indicator_expression: type: object properties: operator: type: string enum: - and - not - or example: and indicator_ids: type: array items: type: string example: string description: A URI leading to an indicator. example: - string required: - operator - indicator_ids example: operator: and indicator_ids: - string likely_impact: type: string example: string description: Likely potential impact within the relevant context if this Indicator were to occur. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: level of confidence held in the accuracy of this Indicator. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: Relevant kill chain phases indicated by this Indicator. test_mechanisms: type: array items: type: string example: string description: String with at most 2048 characters. example: - string description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator. specification: type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. x-anyOf: - type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. - type: object properties: type: type: string enum: - ThreatBrain example: ThreatBrain query: type: string example: string variables: type: array items: type: string example: string example: - string required: - type - variables example: type: ThreatBrain query: string variables: - string description: An indicator which runs in threatbrain... - type: object properties: type: type: string enum: - Snort example: Snort snort_sig: type: string example: string required: - type - snort_sig example: type: Snort snort_sig: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - SIOC example: SIOC SIOC: type: string example: string required: - type - SIOC example: type: SIOC SIOC: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - OpenIOC example: OpenIOC open_IOC: type: string example: string required: - type - open_IOC example: type: OpenIOC open_IOC: string description: An indicator which contains an XML blob of an openIOC indicator. value: title: Event.Indicator.Value type: string example: W32.AdditionVariableCommandObfuscation.ioc description: The canonical label for an indicator. required: - id - producer - value example: description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: 'An indicator is a test, or a collection of judgements that define criteria for identifying the activity, or presence of malware, or other unwanted software. We follow the [STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/) closely, with the exception of not including observables within the indicator, and preferring a _specification_ object encoded in JSON as opposed to an opaque _implementation_ block. Additional, you will want to either define judgements against Observables that are linked to this indicator, with the ID in the _indicators_ field of those Judgements, or you can provide a _specification_ value.' investigationId: type: - string - 'null' investigationShortDescription: type: - string - 'null' investigationSource: type: - string - 'null' confidence: type: string enum: - High - Info - Low - Medium - None - Unknown count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 id: type: string x-anyOf: - type: string - type: string format: uuid observed_time: type: object properties: start_time: type: string end_time: type: - string - 'null' required: - start_time type: type: string enum: - sighting context: {} data: type: object properties: columns: type: array items: type: object properties: name: type: string type: type: string enum: - integer - markdown - number - observable - string - url description: type: - string - 'null' required: type: boolean short_description: type: - string - 'null' required: - name - type rows: type: array items: {} row_count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - columns - rows external_ids: type: array items: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name internal: type: boolean language: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 resolution: type: string enum: - allowed - blocked - contained - detected sensor: type: string sensor_coordinates: type: object properties: observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value os: type: string type: type: string required: - observables - type severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_description: type: string source: type: string source_uri: type: string timestamp: type: string title: type: - string - 'null' tactics_and_techniques: type: array items: title: Mitre tactics and Techniques type: object properties: id: title: MitreID type: string example: TA0003 description: MITRE ATT&CK ID external_id: title: MitreExternalId type: string example: TA0003 description: MITRE ATT&CK ID title: title: MitreTitle type: string example: Persistence short_description: title: MitreShortDescription type: - string - 'null' example: Persistence description: title: MitreDescription type: string example: 'The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.' score: title: MitreScore type: - integer - 'null' format: int64 minimum: 1 maximum: 1000 example: 44 source_url: title: MitreSourceURL type: - string - 'null' example: https://attack.mitre.org/techniques/TA0003 description: The source url for this tactic or technique mitre_type: type: string enum: - tactic - technique - subtechnique required: - id - external_id - title - short_description - description - score - source_url - mitre_type description: A MITRE object from https://attack.mitre.org/ tlp: type: string enum: - amber - green - red - white required: - notable - original - confidence - count - id - observed_time - type required: - events '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: path name: investigation-id description: The investigation in scope required: true title: InvestigationId schema: type: string format: uuid default: 61399c06-5ea8-44ae-8256-cfcf4437ca5a - description: A integer greater than 0. name: limit title: PositiveInteger example: 2 required: false in: query schema: type: integer format: int64 minimum: 0 - description: A integer greater than 0. name: offset title: PositiveInteger example: 2 required: false in: query schema: type: integer format: int64 minimum: 0 - in: query name: sort description: '' required: false allowEmptyValue: true schema: type: string enum: - asc - desc - in: query name: order description: '' required: false allowEmptyValue: true schema: type: string enum: - start_time - time - title - severity - source - in: query name: important_only description: Include only important events required: false schema: type: boolean - in: query name: notable description: '' required: false schema: type: boolean - in: query name: source description: '' required: false x-anyOf: - type: array items: type: string - type: string allowEmptyValue: true schema: type: array items: type: string - in: query name: severity description: '' required: false x-anyOf: - type: array items: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown - type: string allowEmptyValue: true schema: type: array items: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown - in: query name: type description: '' required: false x-anyOf: - type: array items: type: string enum: - Original - Investigated - type: string allowEmptyValue: true schema: type: array items: type: string enum: - Original - Investigated - in: query name: search_text description: '' required: false schema: type: string tags: - v3 summary: Events endpoint from compacted entities. security: - JWT-Bearer: [] - oauth2: [] /v3/investigation/{investigation-id}/graph: get: responses: default: description: '' parameters: - in: path name: investigation-id description: '' required: true schema: type: string - in: query name: important_observables description: Include only data that is related to an important observable required: false schema: type: boolean - in: query name: important_sightings description: Include only data from important events required: false schema: type: boolean - in: query name: important_only description: Include only data from important events required: false schema: type: boolean - in: query name: include_process_parents description: Include parent processes when rendering execution relationships required: false schema: type: boolean tags: - v3 summary: Graph Endpoint from entities. security: - JWT-Bearer: [] - oauth2: [] post: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: object properties: nodes: type: object additionalProperties: type: object properties: data: type: object properties: type: type: string value: type: string asset_id: type: string disposition: type: integer format: int64 indicators: type: array items: type: string uniqueItems: true internal: type: boolean incoming-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true outgoing-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true investigated: type: boolean is_asset: type: boolean observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. disposition: type: integer format: int64 investigated: type: boolean required: - type - value - disposition - investigated properties: type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true x-anyOf: - type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true - type: array items: type: object properties: name: type: string value: {} required: - name - value modules: type: array items: type: string uniqueItems: true sightings: type: array items: type: string uniqueItems: true sources: type: array items: type: string uniqueItems: true title: type: string actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. required: - type - value - indicators - internal - incoming-edges - outgoing-edges - investigated - is_asset - observableType - observables - modules - sightings - sources - title times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true required: - data - times edges: type: object additionalProperties: type: object properties: id1: type: string id2: type: string times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true data: type: object properties: observed_times: type: array items: type: string uniqueItems: true value: type: string sightings: type: array items: type: string uniqueItems: true relation_info: {} required: - value - sightings required: - id1 - id2 - times - data errors: type: array items: type: object properties: type: type: string enum: - E_DATA_TOO_LARGE message: type: string required: - type - message required: - nodes - edges application/transit+msgpack: schema: type: object properties: nodes: type: object additionalProperties: type: object properties: data: type: object properties: type: type: string value: type: string asset_id: type: string disposition: type: integer format: int64 indicators: type: array items: type: string uniqueItems: true internal: type: boolean incoming-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true outgoing-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true investigated: type: boolean is_asset: type: boolean observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. disposition: type: integer format: int64 investigated: type: boolean required: - type - value - disposition - investigated properties: type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true x-anyOf: - type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true - type: array items: type: object properties: name: type: string value: {} required: - name - value modules: type: array items: type: string uniqueItems: true sightings: type: array items: type: string uniqueItems: true sources: type: array items: type: string uniqueItems: true title: type: string actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. required: - type - value - indicators - internal - incoming-edges - outgoing-edges - investigated - is_asset - observableType - observables - modules - sightings - sources - title times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true required: - data - times edges: type: object additionalProperties: type: object properties: id1: type: string id2: type: string times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true data: type: object properties: observed_times: type: array items: type: string uniqueItems: true value: type: string sightings: type: array items: type: string uniqueItems: true relation_info: {} required: - value - sightings required: - id1 - id2 - times - data errors: type: array items: type: object properties: type: type: string enum: - E_DATA_TOO_LARGE message: type: string required: - type - message required: - nodes - edges application/transit+json: schema: type: object properties: nodes: type: object additionalProperties: type: object properties: data: type: object properties: type: type: string value: type: string asset_id: type: string disposition: type: integer format: int64 indicators: type: array items: type: string uniqueItems: true internal: type: boolean incoming-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true outgoing-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true investigated: type: boolean is_asset: type: boolean observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. disposition: type: integer format: int64 investigated: type: boolean required: - type - value - disposition - investigated properties: type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true x-anyOf: - type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true - type: array items: type: object properties: name: type: string value: {} required: - name - value modules: type: array items: type: string uniqueItems: true sightings: type: array items: type: string uniqueItems: true sources: type: array items: type: string uniqueItems: true title: type: string actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. required: - type - value - indicators - internal - incoming-edges - outgoing-edges - investigated - is_asset - observableType - observables - modules - sightings - sources - title times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true required: - data - times edges: type: object additionalProperties: type: object properties: id1: type: string id2: type: string times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true data: type: object properties: observed_times: type: array items: type: string uniqueItems: true value: type: string sightings: type: array items: type: string uniqueItems: true relation_info: {} required: - value - sightings required: - id1 - id2 - times - data errors: type: array items: type: object properties: type: type: string enum: - E_DATA_TOO_LARGE message: type: string required: - type - message required: - nodes - edges application/edn: schema: type: object properties: nodes: type: object additionalProperties: type: object properties: data: type: object properties: type: type: string value: type: string asset_id: type: string disposition: type: integer format: int64 indicators: type: array items: type: string uniqueItems: true internal: type: boolean incoming-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true outgoing-edges: type: array items: type: object properties: id: type: string value: type: string required: - id - value uniqueItems: true investigated: type: boolean is_asset: type: boolean observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. disposition: type: integer format: int64 investigated: type: boolean required: - type - value - disposition - investigated properties: type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true x-anyOf: - type: array items: type: object properties: name: type: string value: {} required: - name - value uniqueItems: true - type: array items: type: object properties: name: type: string value: {} required: - name - value modules: type: array items: type: string uniqueItems: true sightings: type: array items: type: string uniqueItems: true sources: type: array items: type: string uniqueItems: true title: type: string actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. required: - type - value - indicators - internal - incoming-edges - outgoing-edges - investigated - is_asset - observableType - observables - modules - sightings - sources - title times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true required: - data - times edges: type: object additionalProperties: type: object properties: id1: type: string id2: type: string times: type: array items: type: object properties: time: type: integer format: int64 required: - time uniqueItems: true data: type: object properties: observed_times: type: array items: type: string uniqueItems: true value: type: string sightings: type: array items: type: string uniqueItems: true relation_info: {} required: - value - sightings required: - id1 - id2 - times - data errors: type: array items: type: object properties: type: type: string enum: - E_DATA_TOO_LARGE message: type: string required: - type - message required: - nodes - edges '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: path name: investigation-id description: '' required: true schema: type: string - in: query name: important_observables description: Include only data that is related to an important observable required: false schema: type: boolean - in: query name: important_sightings description: Include only data from important events required: false schema: type: boolean - in: query name: important_only description: Include only data from important events required: false schema: type: boolean - in: query name: include_process_parents description: Include parent processes when rendering execution relationships required: false schema: type: boolean tags: - v3 summary: Graph Endpoint from entities. security: - JWT-Bearer: [] - oauth2: [] requestBody: content: application/json: schema: type: - object - 'null' properties: important_observables: description: Include only data that is related to an important observable type: boolean important_sightings: description: Include only data from important events type: boolean important_only: description: Include only data from important events type: boolean include_process_parents: description: Include parent processes when rendering execution relationships type: boolean application/transit+msgpack: schema: type: - object - 'null' properties: important_observables: description: Include only data that is related to an important observable type: boolean important_sightings: description: Include only data from important events type: boolean important_only: description: Include only data from important events type: boolean include_process_parents: description: Include parent processes when rendering execution relationships type: boolean application/transit+json: schema: type: - object - 'null' properties: important_observables: description: Include only data that is related to an important observable type: boolean important_sightings: description: Include only data from important events type: boolean important_only: description: Include only data from important events type: boolean include_process_parents: description: Include parent processes when rendering execution relationships type: boolean application/edn: schema: type: - object - 'null' properties: important_observables: description: Include only data that is related to an important observable type: boolean important_sightings: description: Include only data from important events type: boolean important_only: description: Include only data from important events type: boolean include_process_parents: description: Include parent processes when rendering execution relationships type: boolean /v3/investigation/{investigation-id}/entity/{entity-id}: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: title: Entity.EntityDetail type: object properties: entity: type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity ips: title: Entity.Device.IPs type: array items: type: string example: - 192.168.1.64 - 192.168.1.163 description: The ip addresses of a device required: - id - type - disposition - investigated - label x-anyOf: - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity ips: title: Entity.Device.IPs type: array items: type: string example: - 192.168.1.64 - 192.168.1.163 description: The ip addresses of a device required: - id - type - disposition - investigated - label - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity names: title: Entity.Device.Names type: array items: type: string example: - link@hyrule.net - link description: The names assocated with a user required: - id - type - disposition - investigated - label - names - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity algorithm: title: Entity.Hash.Algorithm.Enum enum: - - sha256 - sha1 - md5 description: The algorithm used to generate this hash example: md5 type: string value: title: Entity.Hash.Value type: string description: The value of the hash example: c804ecb887cbf798f910a71a15771577 required: - id - type - disposition - investigated - label - algorithm - value - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity name: title: Entity.Attachment.Name type: string description: Name of a device example: Link's PC hashes: title: Entity.Attachment.Hashes type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the hashes associated with this attachment example: - 636712a3-2705-4bdb-9639-de8761b57b2b - 20c93a73-cc3c-4012-b807-38a49ec1bfd7 required: - id - type - disposition - investigated - label - name - hashes - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity from: title: Entity.Email.From type: string example: 86518fc4-9401-4ebf-be28-730d2cb91762 description: The Entity ID of the user who sent the email to: title: Entity.Email.To type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the users who received the email example: - 759201b1-bfa2-4e6c-9a66-858e470d86d4 - 06f7cf3a-deb5-4dc6-b08e-b0174d665c10 attachment: title: Entity.Email.Attachment type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the email attachments example: - 61d9d2b4-b0f4-46f6-a309-35651ddcd445 - c2977a99-e0d4-4dc0-abe0-1653bf01e543 required: - id - type - disposition - investigated - label - from - to - attachment activities: type: array items: type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. sighting: title: Activity.Base.Sighting type: array items: type: string example: string description: String with at most 1024 characters. description: The sightings associated with the activity example: - 45ed81d9-8e32-46e2-b604-7cf19114dd91 - d757f328-827d-4fb0-8729-b63f77289d0a observed_times: title: Activity.Base.ObservedTimes type: array items: type: string example: string description: String with at most 1024 characters. description: The observed_times associated with the activity example: - '1727117998000' edges: title: Activity.Base.Edges type: array items: title: Activity.Base.Edges.Edge type: object properties: source: title: Activity.Base.Edges.Edge.Source type: string example: 0617f00c-bcee-4e8b-b18d-3511809c754d description: The Entity ID of the first entity of the relationship related: title: Activity.Base.Edges.Edge.Related type: string example: d126f865-c0eb-4d9f-9818-260263b3a77f description: The Entity ID of the second entity of the relationship relation: title: Activity.Base.Edges.Edge.Relation type: string example: Connected To description: The name of the relationship required: - source - related - relation description: A relationship representing a discrete part of an activity description: The relationships associated with the activity email_message: title: Activity.EmailSent.EmailMessage type: string example: 57c4a6c1-bab0-4994-a652-a4622b4fdc79 description: The Entity ID of the sent message connection_info: title: Activity.EmailSent.ConnectionInfo type: object properties: from_device: title: Activity.EmailSent.ConnectionInfo.FromDevice type: string example: d5fa73df-c9f9-4444-bcbe-7b7ea8d8dfd8 description: The device that relayed the message to the receiving device to_device: title: Activity.EmailSent.ConnectionInfo.ToDevice type: array items: type: string example: string description: String with at most 1024 characters. description: The devices that received the message example: - ef8227ed-95aa-4338-b888-0869ecace0e9 - 71dd40ec-a367-4aa9-92ac-e97ff2550428 required: - from_device - to_device description: The connection information for the sent email required: - id - sighting - observed_times - edges - email_message - connection_info x-anyOf: - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. sighting: title: Activity.Base.Sighting type: array items: type: string example: string description: String with at most 1024 characters. description: The sightings associated with the activity example: - 45ed81d9-8e32-46e2-b604-7cf19114dd91 - d757f328-827d-4fb0-8729-b63f77289d0a observed_times: title: Activity.Base.ObservedTimes type: array items: type: string example: string description: String with at most 1024 characters. description: The observed_times associated with the activity example: - '1727117998000' edges: title: Activity.Base.Edges type: array items: title: Activity.Base.Edges.Edge type: object properties: source: title: Activity.Base.Edges.Edge.Source type: string example: 0617f00c-bcee-4e8b-b18d-3511809c754d description: The Entity ID of the first entity of the relationship related: title: Activity.Base.Edges.Edge.Related type: string example: d126f865-c0eb-4d9f-9818-260263b3a77f description: The Entity ID of the second entity of the relationship relation: title: Activity.Base.Edges.Edge.Relation type: string example: Connected To description: The name of the relationship required: - source - related - relation description: A relationship representing a discrete part of an activity description: The relationships associated with the activity email_message: title: Activity.EmailSent.EmailMessage type: string example: 57c4a6c1-bab0-4994-a652-a4622b4fdc79 description: The Entity ID of the sent message connection_info: title: Activity.EmailSent.ConnectionInfo type: object properties: from_device: title: Activity.EmailSent.ConnectionInfo.FromDevice type: string example: d5fa73df-c9f9-4444-bcbe-7b7ea8d8dfd8 description: The device that relayed the message to the receiving device to_device: title: Activity.EmailSent.ConnectionInfo.ToDevice type: array items: type: string example: string description: String with at most 1024 characters. description: The devices that received the message example: - ef8227ed-95aa-4338-b888-0869ecace0e9 - 71dd40ec-a367-4aa9-92ac-e97ff2550428 required: - from_device - to_device description: The connection information for the sent email required: - id - sighting - observed_times - edges - email_message - connection_info required: - entity - activities description: The details for an entity including it's activities application/transit+msgpack: schema: title: Entity.EntityDetail type: object properties: entity: type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity ips: title: Entity.Device.IPs type: array items: type: string example: - 192.168.1.64 - 192.168.1.163 description: The ip addresses of a device required: - id - type - disposition - investigated - label x-anyOf: - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity ips: title: Entity.Device.IPs type: array items: type: string example: - 192.168.1.64 - 192.168.1.163 description: The ip addresses of a device required: - id - type - disposition - investigated - label - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity names: title: Entity.Device.Names type: array items: type: string example: - link@hyrule.net - link description: The names assocated with a user required: - id - type - disposition - investigated - label - names - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity algorithm: title: Entity.Hash.Algorithm.Enum enum: - - sha256 - sha1 - md5 description: The algorithm used to generate this hash example: md5 type: string value: title: Entity.Hash.Value type: string description: The value of the hash example: c804ecb887cbf798f910a71a15771577 required: - id - type - disposition - investigated - label - algorithm - value - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity name: title: Entity.Attachment.Name type: string description: Name of a device example: Link's PC hashes: title: Entity.Attachment.Hashes type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the hashes associated with this attachment example: - 636712a3-2705-4bdb-9639-de8761b57b2b - 20c93a73-cc3c-4012-b807-38a49ec1bfd7 required: - id - type - disposition - investigated - label - name - hashes - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity from: title: Entity.Email.From type: string example: 86518fc4-9401-4ebf-be28-730d2cb91762 description: The Entity ID of the user who sent the email to: title: Entity.Email.To type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the users who received the email example: - 759201b1-bfa2-4e6c-9a66-858e470d86d4 - 06f7cf3a-deb5-4dc6-b08e-b0174d665c10 attachment: title: Entity.Email.Attachment type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the email attachments example: - 61d9d2b4-b0f4-46f6-a309-35651ddcd445 - c2977a99-e0d4-4dc0-abe0-1653bf01e543 required: - id - type - disposition - investigated - label - from - to - attachment activities: type: array items: type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. sighting: title: Activity.Base.Sighting type: array items: type: string example: string description: String with at most 1024 characters. description: The sightings associated with the activity example: - 45ed81d9-8e32-46e2-b604-7cf19114dd91 - d757f328-827d-4fb0-8729-b63f77289d0a observed_times: title: Activity.Base.ObservedTimes type: array items: type: string example: string description: String with at most 1024 characters. description: The observed_times associated with the activity example: - '1727117998000' edges: title: Activity.Base.Edges type: array items: title: Activity.Base.Edges.Edge type: object properties: source: title: Activity.Base.Edges.Edge.Source type: string example: 0617f00c-bcee-4e8b-b18d-3511809c754d description: The Entity ID of the first entity of the relationship related: title: Activity.Base.Edges.Edge.Related type: string example: d126f865-c0eb-4d9f-9818-260263b3a77f description: The Entity ID of the second entity of the relationship relation: title: Activity.Base.Edges.Edge.Relation type: string example: Connected To description: The name of the relationship required: - source - related - relation description: A relationship representing a discrete part of an activity description: The relationships associated with the activity email_message: title: Activity.EmailSent.EmailMessage type: string example: 57c4a6c1-bab0-4994-a652-a4622b4fdc79 description: The Entity ID of the sent message connection_info: title: Activity.EmailSent.ConnectionInfo type: object properties: from_device: title: Activity.EmailSent.ConnectionInfo.FromDevice type: string example: d5fa73df-c9f9-4444-bcbe-7b7ea8d8dfd8 description: The device that relayed the message to the receiving device to_device: title: Activity.EmailSent.ConnectionInfo.ToDevice type: array items: type: string example: string description: String with at most 1024 characters. description: The devices that received the message example: - ef8227ed-95aa-4338-b888-0869ecace0e9 - 71dd40ec-a367-4aa9-92ac-e97ff2550428 required: - from_device - to_device description: The connection information for the sent email required: - id - sighting - observed_times - edges - email_message - connection_info x-anyOf: - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. sighting: title: Activity.Base.Sighting type: array items: type: string example: string description: String with at most 1024 characters. description: The sightings associated with the activity example: - 45ed81d9-8e32-46e2-b604-7cf19114dd91 - d757f328-827d-4fb0-8729-b63f77289d0a observed_times: title: Activity.Base.ObservedTimes type: array items: type: string example: string description: String with at most 1024 characters. description: The observed_times associated with the activity example: - '1727117998000' edges: title: Activity.Base.Edges type: array items: title: Activity.Base.Edges.Edge type: object properties: source: title: Activity.Base.Edges.Edge.Source type: string example: 0617f00c-bcee-4e8b-b18d-3511809c754d description: The Entity ID of the first entity of the relationship related: title: Activity.Base.Edges.Edge.Related type: string example: d126f865-c0eb-4d9f-9818-260263b3a77f description: The Entity ID of the second entity of the relationship relation: title: Activity.Base.Edges.Edge.Relation type: string example: Connected To description: The name of the relationship required: - source - related - relation description: A relationship representing a discrete part of an activity description: The relationships associated with the activity email_message: title: Activity.EmailSent.EmailMessage type: string example: 57c4a6c1-bab0-4994-a652-a4622b4fdc79 description: The Entity ID of the sent message connection_info: title: Activity.EmailSent.ConnectionInfo type: object properties: from_device: title: Activity.EmailSent.ConnectionInfo.FromDevice type: string example: d5fa73df-c9f9-4444-bcbe-7b7ea8d8dfd8 description: The device that relayed the message to the receiving device to_device: title: Activity.EmailSent.ConnectionInfo.ToDevice type: array items: type: string example: string description: String with at most 1024 characters. description: The devices that received the message example: - ef8227ed-95aa-4338-b888-0869ecace0e9 - 71dd40ec-a367-4aa9-92ac-e97ff2550428 required: - from_device - to_device description: The connection information for the sent email required: - id - sighting - observed_times - edges - email_message - connection_info required: - entity - activities description: The details for an entity including it's activities application/transit+json: schema: title: Entity.EntityDetail type: object properties: entity: type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity ips: title: Entity.Device.IPs type: array items: type: string example: - 192.168.1.64 - 192.168.1.163 description: The ip addresses of a device required: - id - type - disposition - investigated - label x-anyOf: - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity ips: title: Entity.Device.IPs type: array items: type: string example: - 192.168.1.64 - 192.168.1.163 description: The ip addresses of a device required: - id - type - disposition - investigated - label - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity names: title: Entity.Device.Names type: array items: type: string example: - link@hyrule.net - link description: The names assocated with a user required: - id - type - disposition - investigated - label - names - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity algorithm: title: Entity.Hash.Algorithm.Enum enum: - - sha256 - sha1 - md5 description: The algorithm used to generate this hash example: md5 type: string value: title: Entity.Hash.Value type: string description: The value of the hash example: c804ecb887cbf798f910a71a15771577 required: - id - type - disposition - investigated - label - algorithm - value - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity name: title: Entity.Attachment.Name type: string description: Name of a device example: Link's PC hashes: title: Entity.Attachment.Hashes type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the hashes associated with this attachment example: - 636712a3-2705-4bdb-9639-de8761b57b2b - 20c93a73-cc3c-4012-b807-38a49ec1bfd7 required: - id - type - disposition - investigated - label - name - hashes - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity from: title: Entity.Email.From type: string example: 86518fc4-9401-4ebf-be28-730d2cb91762 description: The Entity ID of the user who sent the email to: title: Entity.Email.To type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the users who received the email example: - 759201b1-bfa2-4e6c-9a66-858e470d86d4 - 06f7cf3a-deb5-4dc6-b08e-b0174d665c10 attachment: title: Entity.Email.Attachment type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the email attachments example: - 61d9d2b4-b0f4-46f6-a309-35651ddcd445 - c2977a99-e0d4-4dc0-abe0-1653bf01e543 required: - id - type - disposition - investigated - label - from - to - attachment activities: type: array items: type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. sighting: title: Activity.Base.Sighting type: array items: type: string example: string description: String with at most 1024 characters. description: The sightings associated with the activity example: - 45ed81d9-8e32-46e2-b604-7cf19114dd91 - d757f328-827d-4fb0-8729-b63f77289d0a observed_times: title: Activity.Base.ObservedTimes type: array items: type: string example: string description: String with at most 1024 characters. description: The observed_times associated with the activity example: - '1727117998000' edges: title: Activity.Base.Edges type: array items: title: Activity.Base.Edges.Edge type: object properties: source: title: Activity.Base.Edges.Edge.Source type: string example: 0617f00c-bcee-4e8b-b18d-3511809c754d description: The Entity ID of the first entity of the relationship related: title: Activity.Base.Edges.Edge.Related type: string example: d126f865-c0eb-4d9f-9818-260263b3a77f description: The Entity ID of the second entity of the relationship relation: title: Activity.Base.Edges.Edge.Relation type: string example: Connected To description: The name of the relationship required: - source - related - relation description: A relationship representing a discrete part of an activity description: The relationships associated with the activity email_message: title: Activity.EmailSent.EmailMessage type: string example: 57c4a6c1-bab0-4994-a652-a4622b4fdc79 description: The Entity ID of the sent message connection_info: title: Activity.EmailSent.ConnectionInfo type: object properties: from_device: title: Activity.EmailSent.ConnectionInfo.FromDevice type: string example: d5fa73df-c9f9-4444-bcbe-7b7ea8d8dfd8 description: The device that relayed the message to the receiving device to_device: title: Activity.EmailSent.ConnectionInfo.ToDevice type: array items: type: string example: string description: String with at most 1024 characters. description: The devices that received the message example: - ef8227ed-95aa-4338-b888-0869ecace0e9 - 71dd40ec-a367-4aa9-92ac-e97ff2550428 required: - from_device - to_device description: The connection information for the sent email required: - id - sighting - observed_times - edges - email_message - connection_info x-anyOf: - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. sighting: title: Activity.Base.Sighting type: array items: type: string example: string description: String with at most 1024 characters. description: The sightings associated with the activity example: - 45ed81d9-8e32-46e2-b604-7cf19114dd91 - d757f328-827d-4fb0-8729-b63f77289d0a observed_times: title: Activity.Base.ObservedTimes type: array items: type: string example: string description: String with at most 1024 characters. description: The observed_times associated with the activity example: - '1727117998000' edges: title: Activity.Base.Edges type: array items: title: Activity.Base.Edges.Edge type: object properties: source: title: Activity.Base.Edges.Edge.Source type: string example: 0617f00c-bcee-4e8b-b18d-3511809c754d description: The Entity ID of the first entity of the relationship related: title: Activity.Base.Edges.Edge.Related type: string example: d126f865-c0eb-4d9f-9818-260263b3a77f description: The Entity ID of the second entity of the relationship relation: title: Activity.Base.Edges.Edge.Relation type: string example: Connected To description: The name of the relationship required: - source - related - relation description: A relationship representing a discrete part of an activity description: The relationships associated with the activity email_message: title: Activity.EmailSent.EmailMessage type: string example: 57c4a6c1-bab0-4994-a652-a4622b4fdc79 description: The Entity ID of the sent message connection_info: title: Activity.EmailSent.ConnectionInfo type: object properties: from_device: title: Activity.EmailSent.ConnectionInfo.FromDevice type: string example: d5fa73df-c9f9-4444-bcbe-7b7ea8d8dfd8 description: The device that relayed the message to the receiving device to_device: title: Activity.EmailSent.ConnectionInfo.ToDevice type: array items: type: string example: string description: String with at most 1024 characters. description: The devices that received the message example: - ef8227ed-95aa-4338-b888-0869ecace0e9 - 71dd40ec-a367-4aa9-92ac-e97ff2550428 required: - from_device - to_device description: The connection information for the sent email required: - id - sighting - observed_times - edges - email_message - connection_info required: - entity - activities description: The details for an entity including it's activities application/edn: schema: title: Entity.EntityDetail type: object properties: entity: type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity ips: title: Entity.Device.IPs type: array items: type: string example: - 192.168.1.64 - 192.168.1.163 description: The ip addresses of a device required: - id - type - disposition - investigated - label x-anyOf: - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity ips: title: Entity.Device.IPs type: array items: type: string example: - 192.168.1.64 - 192.168.1.163 description: The ip addresses of a device required: - id - type - disposition - investigated - label - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity names: title: Entity.Device.Names type: array items: type: string example: - link@hyrule.net - link description: The names assocated with a user required: - id - type - disposition - investigated - label - names - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity algorithm: title: Entity.Hash.Algorithm.Enum enum: - - sha256 - sha1 - md5 description: The algorithm used to generate this hash example: md5 type: string value: title: Entity.Hash.Value type: string description: The value of the hash example: c804ecb887cbf798f910a71a15771577 required: - id - type - disposition - investigated - label - algorithm - value - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity name: title: Entity.Attachment.Name type: string description: Name of a device example: Link's PC hashes: title: Entity.Attachment.Hashes type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the hashes associated with this attachment example: - 636712a3-2705-4bdb-9639-de8761b57b2b - 20c93a73-cc3c-4012-b807-38a49ec1bfd7 required: - id - type - disposition - investigated - label - name - hashes - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. type: title: Entity.Type.Enum type: string enum: - device - user - hash - attachment - email description: The type of the entity example: device disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation label: title: Entity.Label type: string example: link.exe description: The canonical label for an entity from: title: Entity.Email.From type: string example: 86518fc4-9401-4ebf-be28-730d2cb91762 description: The Entity ID of the user who sent the email to: title: Entity.Email.To type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the users who received the email example: - 759201b1-bfa2-4e6c-9a66-858e470d86d4 - 06f7cf3a-deb5-4dc6-b08e-b0174d665c10 attachment: title: Entity.Email.Attachment type: array items: type: string example: string description: String with at most 1024 characters. description: The Entity IDs of the email attachments example: - 61d9d2b4-b0f4-46f6-a309-35651ddcd445 - c2977a99-e0d4-4dc0-abe0-1653bf01e543 required: - id - type - disposition - investigated - label - from - to - attachment activities: type: array items: type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. sighting: title: Activity.Base.Sighting type: array items: type: string example: string description: String with at most 1024 characters. description: The sightings associated with the activity example: - 45ed81d9-8e32-46e2-b604-7cf19114dd91 - d757f328-827d-4fb0-8729-b63f77289d0a observed_times: title: Activity.Base.ObservedTimes type: array items: type: string example: string description: String with at most 1024 characters. description: The observed_times associated with the activity example: - '1727117998000' edges: title: Activity.Base.Edges type: array items: title: Activity.Base.Edges.Edge type: object properties: source: title: Activity.Base.Edges.Edge.Source type: string example: 0617f00c-bcee-4e8b-b18d-3511809c754d description: The Entity ID of the first entity of the relationship related: title: Activity.Base.Edges.Edge.Related type: string example: d126f865-c0eb-4d9f-9818-260263b3a77f description: The Entity ID of the second entity of the relationship relation: title: Activity.Base.Edges.Edge.Relation type: string example: Connected To description: The name of the relationship required: - source - related - relation description: A relationship representing a discrete part of an activity description: The relationships associated with the activity email_message: title: Activity.EmailSent.EmailMessage type: string example: 57c4a6c1-bab0-4994-a652-a4622b4fdc79 description: The Entity ID of the sent message connection_info: title: Activity.EmailSent.ConnectionInfo type: object properties: from_device: title: Activity.EmailSent.ConnectionInfo.FromDevice type: string example: d5fa73df-c9f9-4444-bcbe-7b7ea8d8dfd8 description: The device that relayed the message to the receiving device to_device: title: Activity.EmailSent.ConnectionInfo.ToDevice type: array items: type: string example: string description: String with at most 1024 characters. description: The devices that received the message example: - ef8227ed-95aa-4338-b888-0869ecace0e9 - 71dd40ec-a367-4aa9-92ac-e97ff2550428 required: - from_device - to_device description: The connection information for the sent email required: - id - sighting - observed_times - edges - email_message - connection_info x-anyOf: - type: object properties: id: title: Entity.ID type: uuid example: f1b0631b-d370-4de1-ad48-1df4d7b9e7de description: The ID for an entity. sighting: title: Activity.Base.Sighting type: array items: type: string example: string description: String with at most 1024 characters. description: The sightings associated with the activity example: - 45ed81d9-8e32-46e2-b604-7cf19114dd91 - d757f328-827d-4fb0-8729-b63f77289d0a observed_times: title: Activity.Base.ObservedTimes type: array items: type: string example: string description: String with at most 1024 characters. description: The observed_times associated with the activity example: - '1727117998000' edges: title: Activity.Base.Edges type: array items: title: Activity.Base.Edges.Edge type: object properties: source: title: Activity.Base.Edges.Edge.Source type: string example: 0617f00c-bcee-4e8b-b18d-3511809c754d description: The Entity ID of the first entity of the relationship related: title: Activity.Base.Edges.Edge.Related type: string example: d126f865-c0eb-4d9f-9818-260263b3a77f description: The Entity ID of the second entity of the relationship relation: title: Activity.Base.Edges.Edge.Relation type: string example: Connected To description: The name of the relationship required: - source - related - relation description: A relationship representing a discrete part of an activity description: The relationships associated with the activity email_message: title: Activity.EmailSent.EmailMessage type: string example: 57c4a6c1-bab0-4994-a652-a4622b4fdc79 description: The Entity ID of the sent message connection_info: title: Activity.EmailSent.ConnectionInfo type: object properties: from_device: title: Activity.EmailSent.ConnectionInfo.FromDevice type: string example: d5fa73df-c9f9-4444-bcbe-7b7ea8d8dfd8 description: The device that relayed the message to the receiving device to_device: title: Activity.EmailSent.ConnectionInfo.ToDevice type: array items: type: string example: string description: String with at most 1024 characters. description: The devices that received the message example: - ef8227ed-95aa-4338-b888-0869ecace0e9 - 71dd40ec-a367-4aa9-92ac-e97ff2550428 required: - from_device - to_device description: The connection information for the sent email required: - id - sighting - observed_times - edges - email_message - connection_info required: - entity - activities description: The details for an entity including it's activities '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: path name: investigation-id description: '' required: true schema: type: string - in: path name: entity-id description: '' required: true schema: type: string tags: - v3 summary: Get the attributes of an entity security: - JWT-Bearer: [] - oauth2: [] components: securitySchemes: JWT-Bearer: type: apiKey name: Authorization in: header oauth2: type: oauth2 flows: authorizationCode: scopes: event:read: Get event information for an org. Needed to get full report information. private-intel:read: Read data from private intel. Needed to get investigation data. private-intel: Full private intel integration scope. asset: Get Data from Device Insights. Needed during running investigations. enrich:read: Fetch Data about observables. Needed for investigations. integration:read: Get module information. Needed to create a new investigation. investigation: Run investigations. Needed for investigations. casebook: Full casebook management access. Allows read, write to casebooks. casebook:read: Read Casebook access global-intel:read: Read data from public intel. Needed to fetch global incident data and investigations. private-intel:write: Private intel write scope. ao: Execute and read workflows playbook:read: Get playbook state. Needed to get full report information. authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token x-id: - reitit.swagger/default