Intel Exchange API Reference ## Sections • [Intel Exchange API Reference](https://ctixapiv3.cyware.com/intel-exchange-api-reference.md): Intel Exchange is an any-to-any threat intelligence platform (TIP) that is built as a unique solution for the collection, processing, and dissemination of threat intelligence data in various formats. Intel Exchange allows you to receive and share threat intelligence in the form of human and machine-readable packages. By utilizing the Structured Threat Information eXpression (STIX) format and the Trusted Automated Exchange of Intelligence Information (TAXII) mechanism, Intel Exchange achieves Threat Data enrichment and threat intelligence exchange. In addition to that, the Intel Exchange application systematically converts, stores, and organizes actionable threat data across various formats, including STIX 1.x, STIX 2.0, XML, JSON, Cybox, OpenIOC, and MAEC. For more information, see Intel Exchange Product Documentation. For AI agents and LLM-based discovery, see the Intel Exchange LLM-friendly API guide . Supported Intel Exchange Version : 3.6.2 and later versions. You can use Intel Exchange to automate threat intelligence operations and integrate Intel Exchange with other systems in your environment. The Intel Exchange API reference includes the following public API endpoints: Quick Add Intel Threat Data Objects Dashboard Admin Import Intel Threat Mailbox Threat Bulletin Rules Tags • [Authentication](https://ctixapiv3.cyware.com/authentication.md): In Intel Exchange, you can manage user access and feature permissions by defining Open API roles and generating credentials to control access. Generate API credentials Generate the API credentials to get the access ID, secret key, and base URL of your Intel Exchange application. For more information, see Generate Open API Credentials . Generate API Request Parameters To authenticate the API requests made to the Intel Exchange application, you must include the following parameters in the query of each API request: Access ID : Indicates the access ID of your Intel Exchange open API credentials. Expires : Indicates the validity of the signature parameter. The signature becomes invalid if not used within the specified expiry duration. You can set the expiry for a maximum of 30 seconds. Signature : A combination of the access ID, secret key, and expires parameters to authenticate API requests. The signature is hashed using the HMAC-SHA1 algorithm, and then encoded using the Base64 scheme. Use the following Postman script in the pre-request script to generate the Expires and Signature parameters in Postman: JavaScript var accessid = pm.environment.get("accessid"); var secret_key = pm.environment.get("secretkey"); /* -generating epochtime -epochtime is being send in expires parameter of params -sign is generated and then passed for generating signature / pm.environment.set("unixtimestamp", Math.round(Date.now() / 1000)); var expires = pm.environment.get("unixtimestamp") + 20; pm.environment.set('UTC Timezone', new Date().toISOString()); pm.environment.set("expires", expires); var to_sign = accessid + "\n" + expires; / Generate Signature for Authentication -Key based hashing is done using HMAC-SHA1 Algorithm -This is then converted into base64 -Finally the generated signature is URL Encoded so as to make all the special characters URL Safes */ var hash = CryptoJS.HmacSHA1(to_sign, secret_key); var hashInBase64 = CryptoJS.enc.Base64.stringify(hash); hashInBase64 = hashInBase64.replaceAll("+", "+"); hashInBase64 = hashInBase64.replaceAll("/", "/"); hashInBase64 = hashInBase64.replaceAll("=", "="); pm.environment.set("signature", hashInBase64); pm.request.url.query.add('AccessID=' + accessid); pm.request.url.query.add('Signature=' + hashInBase64); pm.request.url.query.add('Expires=' + expires); Use the following Python script to generate the Expires and Signature parameters to use in Python integrations: Python import time import hmac import hashlib import base64 import urllib.parse import requests # Credentials to access CTIX OpenAPI CTIX_SERVER_URL = "https://sample.domain.com/ctixapi" CTIX_ACCESS_ID = "<enter access id>" CTIX_SECRET_KEY = "<enter secret key>" def create_signature(secret_key, message): hashed = hmac.new(secret_key.encode("utf-8"), message.encode("utf-8"), hashlib.sha1) b64_signature = base64.b64encode(hashed.digest()) return urllib.parse.quote_plus(b64_signature) def make_request(method, url, headers, query_params, data=None): print(f"-- Request --------------------------------------------------------") print(f"URL: { url }") print(f"Method: { method }") print(f"Headers: { headers }") print(f"Query Params: { query_params }") print(f"Payload: { data }") response = requests.request( method, url, headers=headers, data=data, params=query_params ) print(f" -- Response ----------------------------------------------------") print(f" Status Code: { response.status_code }") print(f" Response: { response.text }") return response # Get current timestamp in seconds (equivalent to JavaScript's Date.now() / 1000) unix_timestamp = int(time.time()) expires = unix_timestamp + 25 to_sign = f"{CTIX_ACCESS_ID}\n{expires}" signature = create_signature(CTIX_SECRET_KEY, to_sign) # Add AccessID, Signature and Expires to the URL parameters query_params = {"AccessID": CTIX_ACCESS_ID, "Signature": signature, "Expires": expires} # perform a PING request url = f"{ CTIX_SERVER_URL }/ping/" make_request("GET", url, headers={}, query_params=query_params) Define Open API rate limits Define rate limits for your APIs to ensure that all your API users are getting a fair share of the application resources. This also ensures that APIs and servers run smoothly and efficiently. For more information, see Define Rate Limits for Open API in Intel Exchange . • [Ping](https://ctixapiv3.cyware.com/ping.md): Intel Exchange enables you to check the connectivity with a server through the Ping Pong method. The Ping Pong method sends a request called ping to check the connection, and a successful response is called a pong response. • [Ping](https://ctixapiv3.cyware.com/ping/ping.md): Check the server connectivity. Check the connectivity with a server through the Ping Pong method. The Ping Pong method sends a request called ping to check the connection and a successful response is called a pong response. • [Get Ping OpenAPI](https://ctixapiv3.cyware.com/ping/ping-openapi.md): Checks the server connectivity through OpenAPI credentials. • [Administration](https://ctixapiv3.cyware.com/administration.md): Learn about the APIs to manage the administrative features in Intel Exchange, such as: Integration Management Subscriber Management Users and Groups Custom Entities Management Enrichment Management Audit Log Management License Management System Certificate Configuration Collection Management Tag Management • [Integration Management](https://ctixapiv3.cyware.com/administration/integration-management.md): Learn about the APIs to manage various types of integrations, such as threat intel feed sources, third-party providers, Cyware tool integrations, browser extensions, and more. For more information, see Integration Management . • [STIX Source](https://ctixapiv3.cyware.com/administration/integration-management/stix-source.md): Structured Threat Information Expression (STIX) sources deliver threat intel in Intel Exchange in the STIX format. The supported STIX formats are STIX 1.x, STIX 2.0, and STIX 2.1. Use the following APIs to retrieve details about STIX sources and collections. For more information, see STIX Source . • [Get STIX Source Collection List](https://ctixapiv3.cyware.com/administration/integration-management/stix-source/list-stix-source-collections.md): This endpoint allows you to retrieve collections associated with a specific STIX source. You can filter results by source category, paginate through the list of collections, and view detailed information such as collection ID, name, host, polling status, and subscriber details. • [Get Collection Details](https://ctixapiv3.cyware.com/administration/integration-management/stix-source/retrieve-collection-details.md): Returns the details of a STIX source collection. • [Get STIX Source List](https://ctixapiv3.cyware.com/administration/integration-management/stix-source/list-stix-sources.md): Returns a list of custom STIX sources configured in the platform. • [Get STIX Source Categories List](https://ctixapiv3.cyware.com/administration/integration-management/stix-source/list-stix-source-categories.md): STIX sources are classified into categories such as Community, Open Source, Subscriber, and System feed. Use this API to retrieve a list of all available STIX source categories. • [API Integrations](https://ctixapiv3.cyware.com/administration/integration-management/api-integrations.md): Application Programming Interface (API) feeds are software intermediaries that allow two applications to communicate with each other. In Intel Exchange, administrators can configure API feed sources to receive threat intelligence data at specified time intervals. Each API feed source provides unique feed channels to receive different types of threat intelligence data, such as hashes, URLs, indicators, threat actors, and more feeds from various sources. You can manage the API connector configurations and start receiving threat intel packages from the configured API sources. For more information, see API Integrations . This section contains APIs related to the API feed sources in the integration management module. • [Get API Feed List](https://ctixapiv3.cyware.com/administration/integration-management/api-integrations/list-api-feeds.md): Returns a paginated list of available API feed source integrations. • [Get Action Configurations](https://ctixapiv3.cyware.com/administration/integration-management/api-integrations/retrieve-action-configurations.md): Returns all available actions and feed channels of API feed source. • [Get API Feed Source Details](https://ctixapiv3.cyware.com/administration/integration-management/api-integrations/retrieve-api-feed-source-details.md): Returns configuration details of an API feed connector. • [Get API Feed Account Details](https://ctixapiv3.cyware.com/administration/integration-management/api-integrations/retrieve-api-feed-account-details.md): Returns the saved details of an API feed account of an API feed connector. • [Get Accounts of an API Feed Integration](https://ctixapiv3.cyware.com/administration/integration-management/api-integrations/retrieve-accounts-of-an-api-feed-connector.md): Returns all the API feed accounts configured for an API feed connector. • [Get API Feed Channel Configuration](https://ctixapiv3.cyware.com/administration/integration-management/api-integrations/retrieve-api-feed-channel-configuration.md): Returns the saved configuration for all the feed channels of an API feed account. • [Get API Feed Action Configuration](https://ctixapiv3.cyware.com/administration/integration-management/api-integrations/retrieve-api-feed-connector-action-configuration.md): Returns the saved configuration of a given feed channel of an API feed account. • [Get Risk List for API Feed Integration](https://ctixapiv3.cyware.com/administration/integration-management/api-integrations/risk-list-of-app.md): Returns all the available risk list values for a particular API feed connector. • [RSS Feeds](https://ctixapiv3.cyware.com/administration/integration-management/rss-feeds.md): The RSS Feeds API allows you to programmatically access threat intelligence updates shared via RSS feeds. This folder contains APIs for RSS feeds. For more information, see RSS Feeds . • [Get RSS Feed Sources](https://ctixapiv3.cyware.com/administration/integration-management/rss-feeds/retrieve-rss-feed-sources.md): Retrieves the RSS feed sources. • [Get RSS Feed Source Detail](https://ctixapiv3.cyware.com/administration/integration-management/rss-feeds/retrieve-rss-feed-source-detail.md): Returns the details for a particular RSS feed source. • [Email Feed Source](https://ctixapiv3.cyware.com/administration/integration-management/email-feed-source.md): The Email Source API enables you to access and manage threat reports received via integrated email accounts. This module contains APIs for the Email feed source. For more information, see Email Sources . • [Get Email Feed Sources](https://ctixapiv3.cyware.com/administration/integration-management/email-feed-source/retrieve-email-feed-sources.md): Retrieves the list of email sources configured in Intel Exchange. • [Get Email Source Details](https://ctixapiv3.cyware.com/administration/integration-management/email-feed-source/retrieve-email-source-details.md): Returns the API details of an email source. • [Get Email Folders](https://ctixapiv3.cyware.com/administration/integration-management/email-feed-source/retrieve-email-folders.md): Retrieve a list of the folders of an email source. • [Web Scraper](https://ctixapiv3.cyware.com/administration/integration-management/webscraper.md): Webscrapers can be used to get large amounts of data from websites. You can configure webscrapers in Intel Exchange. Use the APIs in this module to look for information related to webscrapers configured in Intel Exchange. For more information, see Web Scraper . • [Get Web Scraper Collections](https://ctixapiv3.cyware.com/administration/integration-management/webscraper/retrieve-web-scraper-collections.md): Retrieves all collections present in the web scraper. • [Webhooks](https://ctixapiv3.cyware.com/administration/integration-management/webhooks.md): A webhook delivers data to an application as it happens. You can configure webhook URLs in Intel Exchange. Use the APIs in this module to look for information related to webhooks configured in Intel Exchange. For more information, see Webhooks . • [Get Webhooks](https://ctixapiv3.cyware.com/administration/integration-management/webhooks/retrieve-webhooks.md): Returns a list of all webhooks configured in Intel Exchange. • [Source Weightage](https://ctixapiv3.cyware.com/administration/integration-management/source-weightage.md): Intel Exchange assigns source weightage to intel source based on the accuracy of data received from it during the past. • [Get Source Weightage](https://ctixapiv3.cyware.com/administration/integration-management/source-weightage/retrieve-source-weightage.md): Retrieves the confidence score of the source from different sources. You can use different endpoints to retrieve the confidence score of different sources as follows: email_accounts rss_feeds webhook • [Tool Integrations](https://ctixapiv3.cyware.com/administration/integration-management/tool-integrations.md): Configure Tool Integrations under Integration Management in Intel Exchange to do the following: Communicate with other Cyware products, such as Collaborate and Orchestrate. Configure integrations with third-party applications, such as SIEM, SOAR, and more. Send information from Intel Exchange to other applications. Perform actions on third-party applications, such as SIEM, SOAR, and more. For more information, see Intel Exchange Tool Integrations . • [Tool Details](https://ctixapiv3.cyware.com/administration/integration-management/tool-integrations/tool-details.md): This API determines the integrated tool types, categories, and sub-categories defined in Intel Exchange. • [Get Tool Categories](https://ctixapiv3.cyware.com/administration/integration-management/tool-integrations/tool-details/retrieve-tool-categories.md): Returns categories and their subcategories for tools configured in Intel Exchange. • [Get Configured Tools](https://ctixapiv3.cyware.com/administration/integration-management/tool-integrations/tool-details/retrieve-configured-tools.md): Returns the list of configured tools in Intel Exchange. • [Get Application Details](https://ctixapiv3.cyware.com/administration/integration-management/tool-integrations/tool-details/retrieve-application-details.md): Returns the details of the configured applications. • [Get SIEM/SOAR Applications](https://ctixapiv3.cyware.com/administration/integration-management/tool-integrations/tool-details/retrieve-siem-soar-applications.md): Returns the list of tools classified under the SIEM (Security Information and Event Management) or the SOAR (Security Orchestration and Automation Response) category. • [Update Tool](https://ctixapiv3.cyware.com/administration/integration-management/tool-integrations/tool-details/update-tool.md): Update the status of the tool to active or inactive. Resetting a tool can erase saved accounts, credentials, and other data. • [Get All Available Tools](https://ctixapiv3.cyware.com/administration/integration-management/tool-integrations/tool-details/retrieve-all-available-tools.md): Returns the list of all available tools and some parameters. • [Tool Accounts](https://ctixapiv3.cyware.com/administration/integration-management/tool-integrations/tool-accounts.md): All the tools added in the Intel Exchange application can have multiple accounts. You can find the APIs related to the different accounts of the third-party integration tools in this section. • [Get Accounts List](https://ctixapiv3.cyware.com/administration/integration-management/tool-integrations/tool-accounts/retrieve-accounts-lists.md): Returns the list of all accounts configured for a tool. • [Test Connectivity](https://ctixapiv3.cyware.com/administration/integration-management/tool-integrations/tool-accounts/test-connectivity.md): This endpoint tests the credentials of an account. • [Actions](https://ctixapiv3.cyware.com/administration/integration-management/tool-integrations/actions.md): In Intel Exchange, you can perform different actions on the configured accounts of your third-party integrated applications. Some of the actions are polling for IOCs, defining a quota for enrichment tools, and more. For more information, see Actions . • [Get Action Details](https://ctixapiv3.cyware.com/administration/integration-management/tool-integrations/actions/retrieve-action-details.md): Returns the details of actions that are defined for an account of a tool. • [Update Action](https://ctixapiv3.cyware.com/administration/integration-management/tool-integrations/actions/update-action.md): Updates a particular action of an account. • [Get Action Configurations](https://ctixapiv3.cyware.com/administration/integration-management/tool-integrations/actions/retrieve-action-configuration.md): Retrieves all the actions of an account. • [Get Rule Actions](https://ctixapiv3.cyware.com/administration/integration-management/tool-integrations/actions/retrieve-rule-actions.md): Returns the list of rule actions that are associated with third-party application integrations configured in Intel Exchange. • [Subscriber Management](https://ctixapiv3.cyware.com/administration/subscriber-management.md): Subscribers are members or entities in the Intel Exchange application with whom you can share intel and information. Use the APIs in this folder to get details about the Intel Exchange subscribers. For more information, see Subscribers. • [Subscriber Weightage](https://ctixapiv3.cyware.com/administration/subscriber-management/subscriber-weightage.md): The Intel Exchange Confidence Score engine calculates the Confidence Score of the intel received from various sources by a weighted average combination of the four parameters, namely Source Sightings, Relations, Enrichment Policy, and Source Confidence. You can assign the source Confidence Score (subscriber weightage) to the subscribers based on the accuracy of data received from them during the past. • [Get Subscriber Weightage](https://ctixapiv3.cyware.com/administration/subscriber-management/subscriber-weightage/get-subscriber-weightage.md): Retrieve the source confidence score of the subscribers configured in the platform. • [Subscriber Report](https://ctixapiv3.cyware.com/administration/subscriber-management/subscriber-report.md): The subscriber reports include polling reports and inboxing reports that provide an overview of the threat data sharing activity across subscribers. • [Get Polling Subscribers Report](https://ctixapiv3.cyware.com/administration/subscriber-management/subscriber-report/polling-subscribers-report.md): Retrieve a list of active and inactive polling subscribers configured in Intel Exchange for a specific time frame. • [Get Inboxing Subscribers Report](https://ctixapiv3.cyware.com/administration/subscriber-management/subscriber-report/inboxing-subscribers-report.md): Retrieve a list of active and inactive inboxing subscribers configured in Intel Exchange for a specific time frame. • [Get Subscribers](https://ctixapiv3.cyware.com/administration/subscriber-management/retrieve-subscribers.md): Returns a list of subscribers configured in the Intel Exchange platform. • [Update Subscriber Status](https://ctixapiv3.cyware.com/administration/subscriber-management/update-subscriber-status.md): Updates the status of a subscriber to active or inactive. • [Users and Groups](https://ctixapiv3.cyware.com/administration/users-and-groups.md): Use APIs in this module to create, update, or view details of users and user groups in Intel Exchange. • [Users](https://ctixapiv3.cyware.com/administration/users-and-groups/users.md): Users allow you to manage the Intel Exchange Users and their permissions. You can assign each user a unique identity, with the necessary access permissions in the Intel Exchange application. For more information, see Create User . • [Get Users](https://ctixapiv3.cyware.com/administration/users-and-groups/users/retrieve-users.md): Returns the list of Intel Exchange users in a paginated format. • [Add User](https://ctixapiv3.cyware.com/administration/users-and-groups/users/create-user.md): Adds a user in Intel Exchange. • [Update User](https://ctixapiv3.cyware.com/administration/users-and-groups/users/update-user.md): Updates the details of a user. • [Get Signed in User Details](https://ctixapiv3.cyware.com/administration/users-and-groups/users/signed-in-user-details.md): Retrieves details of the currently logged-in user. • [Update User Status in Bulk](https://ctixapiv3.cyware.com/administration/users-and-groups/users/bulk-update.md): Perform bulk operations like activating, deactivating, and unblocking the users. • [Get User Details](https://ctixapiv3.cyware.com/administration/users-and-groups/users/user-details.md): Returns the user details of a user. • [User Groups](https://ctixapiv3.cyware.com/administration/users-and-groups/user-groups.md): A user group is a collection of Intel Exchange users segregated based on their access permissions across the application. User Group allows you to give feature specific or action specific permissions to users. For more information, see Create User Group . • [Get User Groups List](https://ctixapiv3.cyware.com/administration/users-and-groups/user-groups/list-groups.md): Returns the user groups in Intel Exchange in a paginated form. • [Create Group](https://ctixapiv3.cyware.com/administration/users-and-groups/user-groups/create-group.md): Creates a user group in Intel Exchange. • [Get Components List](https://ctixapiv3.cyware.com/administration/users-and-groups/user-groups/list-components.md): Lists all the available permissions that can be assigned to a group. • [Update User Group Details](https://ctixapiv3.cyware.com/administration/users-and-groups/user-groups/update-group.md): Updates the details of the user groups like name, active status, and permissions. • [Get User Group Details](https://ctixapiv3.cyware.com/administration/users-and-groups/user-groups/group-details.md): Returns the details of a user group. • [Custom Entitites Management](https://ctixapiv3.cyware.com/administration/custom-entitites-management.md): Custom entities management includes custom components such as custom objects, custom attributes, and custom kill chain phases. Custom entities helps you to characterize threat data objects, attributes, and kill chain phases that are not defined by the standard STIX schema or the standard Kill Chain phases. For more information, see Custom Entities Management . • [Custom Attributes](https://ctixapiv3.cyware.com/administration/custom-entitites-management/custom-attributes.md): Custom attributes help you to add additional information to indicators that are not defined by STIX. Some examples of Custom Attributes include Credit Card number, CVV Number, and Expiry Date. For more information, see Custom Attributes . • [Get Custom Attributes List](https://ctixapiv3.cyware.com/administration/custom-entitites-management/custom-attributes/list-custom-attributes.md): Returns a list of custom attributes from the platform. • [Create Custom Attribute](https://ctixapiv3.cyware.com/administration/custom-entitites-management/custom-attributes/create-custom-attribute.md): Creates a custom attribute in the platform. • [Get Custom Attribute Details](https://ctixapiv3.cyware.com/administration/custom-entitites-management/custom-attributes/retrieve-custom-attribute-details.md): Retrieves the details of a custom attribute. • [Update Custom Attribute](https://ctixapiv3.cyware.com/administration/custom-entitites-management/custom-attributes/update-custom-attribute.md): Updates the details of a custom attribute. • [Custom Objects](https://ctixapiv3.cyware.com/administration/custom-entitites-management/custom-objects.md): Custom Objects are custom STIX objects that provide additional context to any threat intel. Custom Objects characterize threat data components that are not described by STIX components. The application allows you to create custom objects that can be mapped with custom attributes and are used while creating custom intel packages in the application. Custom objects can be organization or sector-specific. Some examples include Payment Card information, IMEI numbers, SIM Card numbers, and so on. For more information, see Custom Objects . • [Get Custom Objects List](https://ctixapiv3.cyware.com/administration/custom-entitites-management/custom-objects/list-custom-objects.md): Retrieves a list of custom objects from the platform. • [Create Custom Object](https://ctixapiv3.cyware.com/administration/custom-entitites-management/custom-objects/create-custom-object.md): Creates a custom object by providing valid data. • [Get Custom Object Details](https://ctixapiv3.cyware.com/administration/custom-entitites-management/custom-objects/retrieve-custom-object-details.md): Retrieves the details of a custom object. • [Update Custom Object](https://ctixapiv3.cyware.com/administration/custom-entitites-management/custom-objects/update-custom-object.md): Updates the details of a custom object. • [Custom Kill Chain](https://ctixapiv3.cyware.com/administration/custom-entitites-management/custom-kill-chain.md): The Cyber Kill Chain is a cybersecurity model created by Lockheed Martin that traces the stages of an attack, identifies vulnerabilities, and helps security teams to stop the attacks at every stage of the chain. MITRE ATT&CK also defines the stages of an attack and helps teams to come up with mitigation tactics and techniques. Apart from using these standard Kill Chains, you can create your own kill chain with its own custom phases suitable for your organization and industry. Create, maintain, and map the custom kill chains when adding intel in Intel Exchange using Detailed Intel Submission. For more information, see Custom Kill Chain . • [Get Custom Kill Chain List](https://ctixapiv3.cyware.com/administration/custom-entitites-management/custom-kill-chain/list-custom-kill-chain.md): Retrieves a list of custom kill chains from the platform. • [Create Custom Kill Chain](https://ctixapiv3.cyware.com/administration/custom-entitites-management/custom-kill-chain/create-custom-kill-chain.md): Creates a custom kill chain with the phases of the kill chain. • [Enrichment Management](https://ctixapiv3.cyware.com/administration/enrichment-management.md): Intel Exchange enriches the threat data by removing false positives, adding contextual information, and scoring indicators by identifying key malicious properties. Intel Exchange has integrations defined with many enrichment tools. Analysts can perform enrichment operations either manually or by configuring an enrichment policy with the help of third-party tool integrations. For more information, see Enrichment Management . • [Enrichment Policy](https://ctixapiv3.cyware.com/administration/enrichment-management/enrichment-policy.md): An enrichment policy automatically enriches the threat intel data coming into the Intel Exchange application. For more information, see Enrichment Policy . • [Get Enrichment Policies](https://ctixapiv3.cyware.com/administration/enrichment-management/enrichment-policy/retrieve-enrichment-policies.md): Lists the enrichment policies in the Intel Exchange application. • [Get Enrichment Policy Details](https://ctixapiv3.cyware.com/administration/enrichment-management/enrichment-policy/retrieve-enrichment-policy-details.md): Retrieves the details of an enrichment policy. • [Enrichment Tools](https://ctixapiv3.cyware.com/administration/enrichment-management/enrichment-tools.md): Use APIs in this module to get the details about the enrichment tools configured in Intel Exchange. For more information, see Enrichment Tools . • [Get Enrichment Tool List](https://ctixapiv3.cyware.com/administration/enrichment-management/enrichment-tools/enrichment-tools-1.md): Returns the list of enrichment tools configured in Intel Exchange. • [Enrichment Details](https://ctixapiv3.cyware.com/administration/enrichment-management/enrichment-details.md): Use the APIs in this module to view enrichment details for threat data objects. You can fetch the details such as enrichment status, verdict of the enrichment, tools used for enrichment and more. • [Get Enriched Objects](https://ctixapiv3.cyware.com/administration/enrichment-management/enrichment-details/retrieve-enriched-objects.md): Retrieves the enriched data in a paginated format. • [Get Enrichment Statistics](https://ctixapiv3.cyware.com/administration/enrichment-management/enrichment-details/retrieve-enrichment-statistics.md): Retrieves enrichment statistics for a provided object ID and the object type. Enrichment statistics include the verdict, number of sources that enriched the object, and their statuses. • [Get Enrichment Object Details](https://ctixapiv3.cyware.com/administration/enrichment-management/enrichment-details/retrieve-enrichment-object-details.md): Retrieves the enrichment data for the given object and tool ID. • [Get Enrichment Status](https://ctixapiv3.cyware.com/administration/enrichment-management/enrichment-details/retrieve-enrichment-status.md): Retrieves the enrichment status. • [Audit Log Management](https://ctixapiv3.cyware.com/administration/audit-log-management.md): Audit logs help administrators monitor the activities in the platform and ensure that users follow the defined protocols of an organization. For more information, see Audit Logs . • [Get User Activity Log List](https://ctixapiv3.cyware.com/administration/audit-log-management/list-user-activity-logs.md): Returns a list of activity logs of a user on the platform. • [Get Subscriber Log List](https://ctixapiv3.cyware.com/administration/audit-log-management/list-subscriber-logs.md): Returns a list of activity logs of a subscriber on the platform. • [Get Configuration Change Log List](https://ctixapiv3.cyware.com/administration/audit-log-management/list-configuration-change-logs.md): Returns a list of logs of the configuration changes in the platform. • [Get Configuration Section List](https://ctixapiv3.cyware.com/administration/audit-log-management/list-configuration-sections.md): Returns the name of the configuration sections in the platform. • [License Management System](https://ctixapiv3.cyware.com/administration/license-management-system.md): Returns leverages the capabilities of the License Management System (LMS) and allows its tenants to utilize them. This API retrieves information about the tenant license. • [Get Tenant Permit Details](https://ctixapiv3.cyware.com/administration/license-management-system/retrieve-tenant-permit-details.md): Returns details about the tenant license. • [Synchronize LMS](https://ctixapiv3.cyware.com/administration/license-management-system/synchronize-lms.md): Synchronizes LMS server data with the Intel Exchange application. • [Get Resource Details List](https://ctixapiv3.cyware.com/administration/license-management-system/retrieve-resource-list-details.md): Returns constraints are configured by the LMS server. • [Retrieve Ingestion Overview Dara](https://ctixapiv3.cyware.com/administration/license-management-system/retrieve-ingestion-overview-dara.md): Retrieves ingestion counts broken down by source and collection across three time windows. Changelog Release v3.7.7.1 Added a new endpoint for retrieving the ingestion data in License Management. • [Refresh Ingestion Data](https://ctixapiv3.cyware.com/administration/license-management-system/refresh-ingestion-data.md): Triggers a recomputation of the ingestion overview data. Changelog Release v3.7.7.1 Added a new endpoint to refresh the ingestion data in License Management. • [Certificate](https://ctixapiv3.cyware.com/administration/certificate.md): Intel Exchange allows you to create and manage certificates used for the authentication of various sources configured for receiving threat intel. These certificates are used as an authentication type for adding intel sources that communicate using the TAXII URL functionality. For more information, see Manage Certificates . • [Get Certificate List](https://ctixapiv3.cyware.com/administration/certificate/retrieve-certificate.md): Returns the list of certificates available in the Intel Exchange platform. • [Configuration](https://ctixapiv3.cyware.com/administration/configuration.md): Intel Exchange enables you to configure various configuration types, such as tenant, authentication, component, SAML, and more. For more information, see Configuration . • [Tenant Configuration](https://ctixapiv3.cyware.com/administration/configuration/tenant-configuration.md): A tenant configuration involves setting up both sides of the network, the server side and the spine side of the network. • [Get Tenant Configuration](https://ctixapiv3.cyware.com/administration/configuration/tenant-configuration/retrieve-tenant-configuration.md): Returns the configurations related to the tenant. • [Get Authentication Configuration](https://ctixapiv3.cyware.com/administration/configuration/tenant-configuration/authentication-configuration.md): Returns the authentication configuration. • [Get Firewall Configuration Details](https://ctixapiv3.cyware.com/administration/configuration/tenant-configuration/firewall-configuration-details.md): Returns the firewall rules defined for a Tenant. This API either allows all the requested IPs or Countries to access the application or blocks all the IPs or Countries. • [Get Component Configuration Details](https://ctixapiv3.cyware.com/administration/configuration/tenant-configuration/component-configuration-details.md): Returns details about the Tenant component configuration. • [Rate Limit](https://ctixapiv3.cyware.com/administration/configuration/rate-limit.md): The rate limit defines the amount of data you receive in a specified period. • [Get OpenAPI Rate Limit Configuration Details](https://ctixapiv3.cyware.com/administration/configuration/rate-limit/openapi-rate-limit-configuration-details.md): Returns details about the OpenAPI rate limits configuration. • [Get TAXII Rate Limit Configuration Details](https://ctixapiv3.cyware.com/administration/configuration/rate-limit/taxii-rate-limit-configuration-details.md): Returns details about TAXII configuration rate limits. • [Ingestion Service Config](https://ctixapiv3.cyware.com/administration/configuration/ingestion-service-config.md): Returns configuration of the ingestion service. • [Get Ingestion Service Configuration](https://ctixapiv3.cyware.com/administration/configuration/ingestion-service-config/retreive-config.md): Returns config for ingestion service. • [TAXII Server Configuration](https://ctixapiv3.cyware.com/administration/configuration/taxii-server-configuration.md): Use the APIs in this module to retrieve the TAXII server configuration details of the platform. • [Get TAXII Configuration Details](https://ctixapiv3.cyware.com/administration/configuration/taxii-server-configuration/taxii-configuration-details.md): This endpoint retrieves the configuration details of the TAXII server on the platform. • [System Notifications](https://ctixapiv3.cyware.com/administration/configuration/system-notifications.md): You can configure the system notifications of the platform to send timely in-app and email notifications to relevant users about errors related to feed sources, subscribers, rules, and API credentials. The notifications enable the users to take proactive measures and avoid any disruption in the platform. • [Get Feed Source Report](https://ctixapiv3.cyware.com/administration/configuration/system-notifications/feed-source-report.md): Returns the system notification configuration for email feed sources. • [Get Internal Failure Reports](https://ctixapiv3.cyware.com/administration/configuration/system-notifications/internal-failure-reports.md): Returns the system notification configuration for internal failure reports. • [Get API Expiry Report](https://ctixapiv3.cyware.com/administration/configuration/system-notifications/api-expiry-report.md): Returns the system notification configuration for the OpenAPI expiry report. • [Custom Scores](https://ctixapiv3.cyware.com/administration/configuration/custom-scores.md): Custom scores for threat data objects provide you the flexibility to define scores based on the parameters that impact the lifecycle of indicators of compromise (IOCs), such as relevance, severity, risk, and more. • [Get Custom Scores](https://ctixapiv3.cyware.com/administration/configuration/custom-scores/retrieve-custom-scores.md): Returns all the custom scores. • [Create Custom Score](https://ctixapiv3.cyware.com/administration/configuration/custom-scores/create-custom-score.md): Creates a new custom score. You can add a maximum of five custom scores. • [Update Custom Score](https://ctixapiv3.cyware.com/administration/configuration/custom-scores/update-custom-score.md): Updates a custom score. • [Get Table Layout Configurations](https://ctixapiv3.cyware.com/administration/configuration/table-layout-configurations.md): Fetches details about layout configurations for the given component. • [Collection Management](https://ctixapiv3.cyware.com/administration/collection-management.md): Collections are groupings in Intel Exchange which contain intel collected from different sources. The collections categorize threat intel and help you differentiate information while sharing it with subscribers. • [Get Collections List](https://ctixapiv3.cyware.com/administration/collection-management/list-collections.md): Returns a paginated list of collections in Intel Exchange. • [Create Collection](https://ctixapiv3.cyware.com/administration/collection-management/create-collection.md): Create a STIX collection in the Intel Exchange application. • [Update Collection](https://ctixapiv3.cyware.com/administration/collection-management/update-collection.md): Use this API to update any attributes of a collection. • [Tag Management](https://ctixapiv3.cyware.com/administration/tag-management.md): Tags are labels or keywords used to categorize and organize threat intel. They help classify and group related data, making it easier to search, filter, and manage the information within the platform. From user-defined tags to source, system, and privileged access tags, this provides a seamless platform to organize and administer tag categories. For more information, see Tag Management . • [Get Tags](https://ctixapiv3.cyware.com/administration/tag-management/retrieve-tags.md): Returns all tags from Intel Exchange. • [Create Tags](https://ctixapiv3.cyware.com/administration/tag-management/create-tags.md): Create multiple tags with one request. You can create a maximum of 15 tags in one API request. • [Bulk Enable/Disable Tags](https://ctixapiv3.cyware.com/administration/tag-management/bulk-enable-disable-tags.md): Enables or disables multiple tags. You can update the tag of the same category. • [Quick Add Intel](https://ctixapiv3.cyware.com/quick-add-intel.md): Quick Add Intel enables you to quickly add intel into Intel Exchange by providing some basic details. This section describes how to use the API endpoints related to Quick Add Intel. For more information, see Quick Add Intel . • [Create Parse IOCs Task](https://ctixapiv3.cyware.com/quick-add-intel/create-parse-iocs-task.md): Creates an IOC parsing task to extract STIX objects from free text data or a web page. Currently, this API endpoint does not support parsing IOCs from files such as PDF, CSV, XLS, and others. • [Get Parse IOCs Task Status](https://ctixapiv3.cyware.com/quick-add-intel/retrieve-parse-iocs-task-status.md): Returns the status of a parse IOCs task. Parsing Task Status Codes The following table provides an overview of the different statuses for a parsing task Numeric Status Status Value Description 0 enqueued The parsing task is in the queue for processing. 1 running The parsing task is being processed. 2 failed Failed to process parsing due to invalid input. 3 done The parsing task has been completed. Use the Get Parsed IOCs endpoint to retrieve the parsed IOCs. 5 delayed Parsing is delayed due to too many tasks in the queue. Try again after some time. 6 cancelled Parsing has been manually cancelled by the user. 7 aborted Parsing was aborted due to some unexpected error. Create a new parsing task. • [Get Parsed IOCs List](https://ctixapiv3.cyware.com/quick-add-intel/retrieve-parsed-iocs.md): Returns a list of parsed IOCs as STIX objects after successfully processing the Create Parse IOCs Task endpoint. Also indicates whether each IOC exists in the platform’s Allowed Indicators list. • [Get Regions List](https://ctixapiv3.cyware.com/quick-add-intel/list-regions.md): Returns the list of STIX 2.1 region open vocabulary . These regions can be used to specify locations in the Quick Add Intel endpoint. • [Get Country Codes List](https://ctixapiv3.cyware.com/quick-add-intel/list-country-codes.md): Returns a list of country codes based on the STIX 2.1 enumeration . These country codes can be used to specify locations in the Quick Add Intel endpoint. • [Get Quick Add Intel History List](https://ctixapiv3.cyware.com/quick-add-intel/list-quick-add-intel-history.md): Returns a list of intel added using quick add intel. • [Get Quick Add Intel Statistics](https://ctixapiv3.cyware.com/quick-add-intel/retrieve-quick-add-intel-statistics.md): Returns the statistics of the Quick Add Intel history. Intel Processing Statuses Status Description DRAFT The intel has been created but has not yet been submitted for processing. PENDING The intel is awaiting processing. PARSED The intel has been successfully processed and parsed into relevant data structures. PUBLISHED The intel has been successfully processed and parsed into relevant data structures. PROCESSING The intel is currently being analyzed and processed. CREATED The intel has been added to the system but has not yet moved to further stages. DELETED The intel has been removed from the system. FAILED The processing attempt was unsuccessful. PARTIALLY SUCCESSFUL Some elements of the intel were processed successfully, but others encountered issues. • [Quick Add Intel](https://ctixapiv3.cyware.com/quick-add-intel/quick-add-intel.md): Creates intel by providing minimal details of indicators, SDOs, relations, custom objects, and indicators parsed from free text. Default Source : Import Default Collection : Free Text Note : At least one of the indicators , sdos , observables , or custom_objects is required to create an intel. The Indicators Object The indicators object in Quick Add Intel accepts the IOC type as the key and a comma-separated list of IOC values as the value. You can pass a maximum of 5000 characters as the IOC value per IOC type. For the allowed list of IOC types and the respective key to pass in the indicators object, refer to the following table: IOC Type IOC Key IPv4 ipv4-addr IPv6 ipv6-addr Domain domain URL url Email Address email MD5 md5 SHA1 sha1 SHA224 sha224 SHA256 sha256 SHA384 sha384 SHA512 sha512 SSDEEP ssdeep The Parse Indicators Object The parse_indicators object in Quick Add Intel accepts the IOC type as the key and a list of parsed IOC values as the value. For the allowed list of IOC types and the respective key to pass in the parse_indicators object, refer to the following table: IOC Type IOC Key IPv4 ips IPv6 ipv6 Domain domains URL urls Email Address emails MD5 md5 SHA1 sha1 SHA224 sha224 SHA256 sha256 SHA384 sha384 SHA512 sha512 SSDEEP ssdeep CVE IDs cve_ids Windows Registry Key registry_key_path File Paths file_paths Autonomous System as X.509 certificates x509-certificate MAC Address mac-addr The Custom Objects Object The custom_objects object in Quick Add Intel accepts the ID of a custom object as the key and a list of custom attribute objects as the value. The custom attribute object accepts the name of the primary attribute of a custom object as the key and the attribute value as the value. To retrieve the custom object IDs and the respective primary attribute, use the GET Custom Object Details API in Administration > Custom Entities Management > Custom Objects . The SDOs Object The sdos object in Quick Add Intel accepts the STIX Domain Object (SDO) type as the key and a comma-separated list of SDO values as the value. You can pass a maximum of 5000 characters as the SDO value per SDO type. For the allowed list of SDO types and the respective key to pass in the sdos object, refer to the following table: SDO Type SDO Key Vulnerability vulnerability Malware malware Campaign campaign Threat Actor threat-actor Intrusion Set intrusion-set Attack Pattern attack-pattern Incident incident Course of Action course-of-action Identity identity Tool tool Infrastructure infrastructure Location location Malware Analysis malware-analysis The Observables Object The observables object in Quick Add Intel accepts the STIX Cyber Observable Object (SCO) type as the key and a comma-separated list of SCO values as the value. You can pass a maximum of 5000 characters as the SCO value per SCO type. For the allowed list of SCO types and the respective key to pass in the observables object, refer to the following table: SCO Type SCO Key Artifact artifact Directory directory Email Message email-message MAC Address mac-addr Mutex mutex ​Network Traffic network-traffic Process process Software software User Account user-account X.509 Certificate x509-certificate File file • [Get Quick Add Intel Status](https://ctixapiv3.cyware.com/quick-add-intel/retrieve-quick-add-intel-status.md): Retrieve the intel creation status of a quick add intel submission. This API requires the unique ID of the background task created by the system to create intel. • [Get Quick Add Intel Relation Objects](https://ctixapiv3.cyware.com/quick-add-intel/retrieve-quick-add-intel-relation-objects.md): Retrieve the details of the threat objects (indicators, SDOs, SCOs, relations, and custom objects) that are ingested and added as relationship objects of the report that is created as part of the quick add intel submission. • [Import Intel](https://ctixapiv3.cyware.com/import-intel.md): You can import intel from structured data sources such as STIX bundles, CSV files, and OpenIOC into ​Intel Exchange and use these imported sources to create intel within the platform. For more information, see Import Intel into Intel Exchange . • [Import Intel](https://ctixapiv3.cyware.com/import-intel/import-intel.md): Imports threat data to Intel Exchange. The formats supported for import are as follows: Format Value Allowed File Type Default Collection MISP misp .json misp Open IOC openioc .xml openioc STIX 1.x stix1 .xml .xml STIX 2.1 stix2 .json Stix2 STIX 2.0 stix20 .json Stix2 STIX 1.x URL stix1url URL url CSV (Recorded Future) csv-recorded-future .csv csv CSV (Cyware) cy-csv .csv csv Optionally, you can specify a collection to which the file is imported. If no collection is specified, the data is imported to the default collection. To retrieve import collections, use the Get Source Collections endpoint. For STIX 1.x URL, the body must include the URL value. For more information, see the example request. • [Get Source Collections](https://ctixapiv3.cyware.com/import-intel/source-collections.md): Retrieves import collections from Intel Exchange. • [Create Intel via Open API](https://ctixapiv3.cyware.com/create-intel-via-open-api.md): Create intel with additional details such as the source and collection to better group and correlate data. • [Create Intel via Open API](https://ctixapiv3.cyware.com/create-intel-via-open-api/create-intel-via-open-api.md): Create intel with additional details such as the source and collection. You can also include details for each object, such as description, notes, custom attributes, and more. The All SDOs Object The all_sdos object accepts all_iocs and the SDO type as the key, and a list of objects for the respective IOC and SDO type. For a list of the supported SDO types, refer to the following table. Title SDO Key Vulnerability vulnerabilities Malware malwares Campaign campaigns Threat Actor threat_actor Intrusion Set intrusion_sets Attack Pattern attack_patterns Incident incidents Course of Action course_of_actions Identity identities Tool tools Infrastructure infrastructures Location locations Malware Analysis malware_analysis Custom Objects custom_objects File files Grouping groupings Indicator indicators Marking Definition marking_definitions Note notes Observed Data observed_datas Opinion opinions Relatioship relationships Observables cyber_observables Software softwares The All IOCs Object The all_iocs object accepts the IOC type as the key and a list of objects for the respective IOC type. For a list of the supported IOC types, refer to the following table. IOC Type IOC Key IPv4 ipv4 IPv6 ipv6 Domain domain URL url Email Address email_address MD5 md5 SHA1 sha1 SHA224 sha224 SHA256 sha256 SHA384 sha384 SHA512 sha512 SSDEEP ssdeep • [Ingest Bundle](https://ctixapiv3.cyware.com/create-intel-via-open-api/ingest-bundle.md): The Ingest Bundle endpoint allows you to import threat intelligence data into Intel Exchange in STIX format. Using this endpoint, you can directly ingest STIX bundles from external sources into collections for further enrichment and analysis. You can ingest bundles in two ways: With Source and Collection Name : Ingest data by specifying the STIX source and collection name. With Source and Collection ID : Ingest data by referencing the unique collection ID linked to a STIX source. • [With Source and Collection Name](https://ctixapiv3.cyware.com/create-intel-via-open-api/ingest-bundle/with-source-and-collection-name.md): Use this API to ingest a STIX bundle into Intel Exchange by specifying the source and collection name. A STIX bundle can include any combination of STIX Domain Objects (SDOs). For more information on supported objects, see the STIX documentation . If you pass an invalid or missing source_name or collection_name , the bundle is ingested with the source set to Import and the collection set to STIX2 . • [With Source and Collection ID](https://ctixapiv3.cyware.com/create-intel-via-open-api/ingest-bundle/with-source-and-collection-id.md): Use this API to ingest a STIX bundle into Intel Exchange by specifying the source and collection ID. A STIX bundle can include any combination of STIX Domain Objects (SDOs). For more information on supported objects, see the STIX documentation . If you pass an invalid or missing source_id or collection_id , the bundle is ingested with the source set to Import and the collection set to STIX2 . • [Threat Data](https://ctixapiv3.cyware.com/threat-data.md): Intel received in Intel Exchange from different sources is categorized into various STIX object types, normalized, and deduplicated for further analysis. The Threat Data module displays all the ingested objects for analysis and actioning. For more information, see Threat Data . • [Get Threat Data List](https://ctixapiv3.cyware.com/threat-data/list-threat-data.md): Returns a list of threat data objects from Intel Exchange using a CQL query. You can retrieve a maximum of 500,000 threat data objects using this API. Use the following field mapping and operator references to write accurate CQL queries for this endpoint. CQL Field Mapping: UI vs API The following table maps UI field labels and their associated values to the corresponding API field keys and values used in the CQL module. Use this mapping to write accurate CQL queries in the API. UI Label API Query Key Accepted Values (UI label -> API Query Key) Object Type type Indicator → indicator Malware → malware Threat Actor → threat-actor Vulnerability → vulnerability Attack Pattern → attack-pattern Campaign → campaign Course of Action → course-of-action Identity → identity Infrastructure → infrastructure Intrusion Set → intrusion-set Location → location Malware Analysis → malware-analysis Observed Data → observed-data Opinion → opinion Tool → tool Report → report IOC type ioc_type Artifact → artifact Autonomous system → autonomous-system Directory → directory Domain → domain-name Email addr → email-addr Email message → email-message File → file Ipv4 addr → ipv4-addr Ipv6 addr → ipv6-addr Mac addr → mac-addr MD5 → MD5 Mutex → mutex Network traffic → network-traffic Process → process SHA1 → SHA-1 SHA224 → SHA-224 SHA384 → SHA-384 SHA512 → SHA-512 Software → software SSDEEP → SSDEEP URL → url User account → user-account Windows registry key → windows-registry-key X509 certificate → x509-certificate YARA → yara Custom Object Type custom_object_type Custom object types are platform-defined. For example, text will appear as x-test in API queries. Source source Each source in the UI maps to a unique source ID in the API. These IDs vary based on the sources configured in your instance. Source Type source_type STIX → CUSTOM_STIX_SOURCES APIs → API_FEEDS Email → EMAIL_ACCOUNTS RSS → RSS_FEED X (Twitter) → TWITTER_FEEDS Web Scraper → WEB_SCRAPPER Sandbox → MALWARE_SANDBOX Miscellaneous → MISCELLANEOUS Source Collections source_collection Each source collection maps to a unique ID used in API queries. These values vary based on the collections configured in your instance. Source Confidence source_confidence High → HIGH Medium → MEDIUM Low → LOW None → NONE Source Confidence Value source_confidence_value Pass an integer value representing the confidence score in the API. Source Created source_created Use an EPOCH timestamp to filter results by the created date in your API query. Source Modified source_modified Use an EPOCH timestamp to filter results by the modified date in your API query. Value value Pass a custom string to match or filter against user-defined input. Published Collection published_collection Use the collection’s unique ID to filter by a specific published collection. Published Date published_on Pass an EPOCH timestamp to filter indicators by their published date. Imported File Date imported_file_on Pass an EPOCH timestamp to filter indicators by their imported file date. Imported File imported_file Provide any string value as the label for the imported file. System Created Date ctix_created Use an EPOCH timestamp to filter by the system creation date in API queries. System Modified Date ctix_modified Use an EPOCH timestamp to filter by the system modification date in API queries. Risk Score confidence_score Provide an integer value to represent the risk or confidence level in your API query. TLP tlp Red → RED Amber+Strict → AMBER_STRICT Amber → AMBER Green → GREEN Clear → CLEAR None → NONE Valid Until valid_until Pass an EPOCH timestamp to specify the expiry date of the indicator in your API query Valid From valid_from Pass an EPOCH timestamp to define when the indicator becomes valid in your API query. Tag Category tag_type Source → source User → user System → system Privileged Access → privileged Group → group Tags tags Pass the unique tag ID in your API query. Each tag in the UI corresponds to a specific ID. Analyst Score analyst_score Provide an integer value in the API to indicate the analyst-assigned score. Analyst CVSS Score analyst_cvss_score Pass an integer value to represent the analyst-assigned CVSS score. Countries countries Use the exact country name as shown in the UI. The API expects the same value without any change in casing or format. First Seen first_seen Pass the date as an EPOCH timestamp when querying through the API. Last Seen last_seen Pass the date as an EPOCH timestamp when querying through the API. Deprecation Status is_deprecated Deprecated → true Not Deprecated → false False Positive Status is_false_positive True → true False → false Review Status is_reviewed Reviewed → true Not Reviewed → false Revoke Status is_revoked Revoked → true Not Revoked → false Manual Review is_under_review Yes → true No → false Included in Allowed Indicators is_whitelisted Yes → true No → false Actioned By actioned_by Pass the system-generated user ID when querying through the API. Actioned Date actioned_on Use an EPOCH timestamp to filter results by actioned date in the API. Action Medium action_type Manual → manual Rule → automatic Actioned App Type aapp_type CTIX → ctix 3rd Party → third_party Actioned App app_name Use the app name exactly as shown in the UI. The API expects the value with the same casing and format, without any changes. Relation Created Date relation_created Pass the date as an EPOCH timestamp in the API. Relation Modified Date relation_modified Pass the date as an EPOCH timestamp in the API. Relation Type relationship_type Pass either predefined or custom relationship types in the API. Common default types include duplicate-of , derived-from , and related-to . Related Object Property related_object_property Values are populated dynamically based on platform configuration for related object properties. Related Object related_object Use this key in your API queries. Values are the same as those used in the Object Type field. Has Relations has_relations Yes → true No → false Sighting Located sighting_located Yes → true No → false Sighting Observed sighting_observed Yes → true No → false Sighting First Seen sighting_first_seen Pass an EPOCH timestamp in your API query to specify when the sighting was first observed. Sighting Last Seen sighting_last_seen Pass an EPOCH timestamp in your API query to specify when the sighting was last observed. Sighting Source Created sighting_source_created Pass an EPOCH timestamp in your API query to define when the source created the sighting. Sighting Source Modified sighting_source_modified Pass an EPOCH timestamp in your API query to define when the source last modified the sighting. CQL Conditions : Learn about conditional operators used in CQL expressions. CQL Operators : Understand the supported comparison and logical operators in CQL. For more information, see CQL documentation . • [Export](https://ctixapiv3.cyware.com/threat-data/export.md): Export threat data objects from the Intel Exchange application into a CSV file for offline analysis. • [Generate Export File](https://ctixapiv3.cyware.com/threat-data/export/generate-export-file.md): Initiates export of threat data objects to a CSV file based on the CQL input. This API returns a file ID to retrieve the export file download link. You can export a maximum of 100,000 threat data objects in one API request. The Column Object Each column object includes the key and value of a column. You can include the following columns in the export file: Key Value name Value type Type tlp TLP tags Tags sources Source source_collections Source Collection published_collections Published Collections ctix_created System Created Date ctix_modified System Modified Date country Country analyst_score Analyst Score source_confidence Source Confidence • [Get Download Link](https://ctixapiv3.cyware.com/threat-data/export/retrieve-download-link.md): Retrieves a URL to download the export file. The URL includes the file ID and a token. • [Get Export File](https://ctixapiv3.cyware.com/threat-data/export/download-export-file.md): Retrieves the export data in CSV format. • [Bulk Actions](https://ctixapiv3.cyware.com/threat-data/bulk-actions.md): Perform an action on multiple threat data objects with one API request. • [Bulk Add/Remove Allowed Indicators](https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-add-remove-allowed-indicators.md): Add or remove multiple threat data objects from the Allowed Indicators list in the platform. • [Bulk Add/Remove Tags](https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-add-remove-tags.md): Use the Bulk Add/Remove endpoints to add or remove tags from multiple threat data objects in a single request. • [Bulk Add Tags](https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-add-remove-tags/bulk-add-remove-tags.md): Add tags from multiple threat data objects. You can remove a maximum of 50 tags from a maximum of 100 objects with one API request. • [Bulk Remove Tags](https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-add-remove-tags/bulk-remove-tags.md): Remove tags from multiple threat data objects. You can remove a maximum of 50 tags from a maximum of 100 objects with one API request. • [Bulk Add/Remove Watchlist](https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-add-remove-watchlist.md): Add or remove multiple threat data objects from the watchlist. • [Bulk Add Analyst Score](https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-add-analyst-score.md): Add the analyst Confidence Score to multiple threat data objects. • [Bulk Add Relation](https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-add-relation.md): Add a relation to multiple threat data objects. • [Bulk Add TLP](https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-add-tlp.md): Add an analyst TLP to multiple threat data objects. • [Bulk Deprecate/Undeprecate Objects](https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-deprecate-undeprecate-objects.md): Deprecate or undeprecate multiple threat data objects with one API request. • [Bulk Manual Review](https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-manual-review.md): Mark multiple threat data objects for manual review or mark the objects as reviewed. • [Bulk Mark/Unmark False Positive](https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-mark-unmark-false-positive.md): Mark or unmark multiple IOCs as false positives in Intel Exchange • [Bulk Run Rule](https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-run-rule.md): Add a rule on multiple threat data objects. You can run rules that are configured for manual execution only. • [Bulk IOC Lookup and Create Intel](https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-ioc-lookup-and-create-intel.md): Perform a lookup for IOCs to retrieve the list of objects available in Intel Exchange. If some IOCs are not available in the platform, you can choose to create intel and ingest the missing IOCs. You can look up and ingest a maximum of 1000 IOCs in an API request. You can perform a lookup for the following IOC types: IPv4 IPv6 Email Address MD5 SHA1 SHA256 SHA512 SSDEEP URL Domain • [Bulk IOC Lookup (Advanced)](https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-ioc-lookup-advanced.md): Performs a lookup for threat data objects in Intel Exchange and retrieves the details of the objects, such as basic details, enriched data, and relations. • [Quick Preview](https://ctixapiv3.cyware.com/threat-data/quick-preview.md): Use quick preview in Threat Data to retrieve specific details of a threat data object. • [Get Threat Data Object Preview](https://ctixapiv3.cyware.com/threat-data/quick-preview/preview-threat-data-object.md): Retrieves specific details of a threat data object. • [Miscellaneous](https://ctixapiv3.cyware.com/threat-data/miscellaneous.md): This section includes the APIs to retrieve IOC types, country details, source types, sources, and collections of the sources. Supported SDO Types Intel Exchange supports the following SDO types in Threat Data: SDO Type SDO Key Vulnerability vulnerability Malware malware Campaign campaign Threat Actor threat-actor Intrusion Set intrusion-set Attack Pattern attack-pattern Incident incident Course of Action course-of-action Identity identity Tool tool Infrastructure infrastructure Location location Malware Analysis malware-analysis Custom Objects custom-object Indicator indicator Note note Observed Data observed-data Opinion opinion Report report Observables observable • [Get IOC Types List](https://ctixapiv3.cyware.com/threat-data/miscellaneous/list-ioc-types.md): Retrieves all the valid IOC types in Intel Exchange. • [Get Countries List](https://ctixapiv3.cyware.com/threat-data/miscellaneous/list-countries.md): Retrieves the details of a list of countries. • [Get Source Types List](https://ctixapiv3.cyware.com/threat-data/miscellaneous/list-source-types.md): Returns the types of feed sources available in Intel Exchange. • [Get Sources List](https://ctixapiv3.cyware.com/threat-data/miscellaneous/list-sources.md): Returns a list of feed sources from Intel Exchange • [Get Source Collections List](https://ctixapiv3.cyware.com/threat-data/miscellaneous/list-source-collections.md): Returns a list of collections for the sources. • [Saved Search](https://ctixapiv3.cyware.com/threat-data/saved-search.md): Save the frequently searched threat data elements and CQL queries. You can share a saved search with other users for use. • [Get Saved Searches List](https://ctixapiv3.cyware.com/threat-data/saved-search/list-saved-searches.md): Lists the threat data queries that are saved by the user. • [Get Saved Search Details](https://ctixapiv3.cyware.com/threat-data/saved-search/saved-search-details.md): Retrieves the details of a saved search. • [Create Saved Search](https://ctixapiv3.cyware.com/threat-data/saved-search/create-saved-search.md): Creates a saved search in Intel Exchange. • [Update Saved Search](https://ctixapiv3.cyware.com/threat-data/saved-search/update-saved-search.md): Updates the saved search data in Intel Exchange. • [Delete Saved Search](https://ctixapiv3.cyware.com/threat-data/saved-search/delete-saved-search.md): Deletes a saved search. • [Pin Saved Search](https://ctixapiv3.cyware.com/threat-data/saved-search/pin-saved-search.md): Pins a saved search in Intel Exchange. • [Remove Pined Saved Search](https://ctixapiv3.cyware.com/threat-data/saved-search/remove-pined-saved-search.md): Removes a saved search from the pinned search list. • [Update Pinned Saved Search](https://ctixapiv3.cyware.com/threat-data/saved-search/update-pinned-saved-search.md): Updates the order of a pinned saved search in Intel Exchange. • [AI-Assisted Search](https://ctixapiv3.cyware.com/threat-data/ai-assisted-search.md): Converts a natural language prompt into an Intel Exchange search query. Changelog Release v3.7.7.0 Added a new endpoint for AI-assisted search in Threat Data. • [Threat Data Objects](https://ctixapiv3.cyware.com/threat-data-objects.md): Intel Exchange segregates the different formats of threat intel received into STIX Objects such as Indicators, Vulnerabilities, TTPs, Malware, Campaign, Threat Actor, Intrusion Set, Attack Pattern, Incident, Course of Action, Identity, Kill Chain, Kill Chain Phases, and Tool. For more information, see Threat Data Objects . • [Basic Details](https://ctixapiv3.cyware.com/threat-data-objects/basic-details.md): Retrieves details about the threat data objects in Intel Exchange. • [Get Threat Data Object Details List](https://ctixapiv3.cyware.com/threat-data-objects/basic-details/list-threat-data-object-details.md): Returns basic correlated details of a threat data object in Intel Exchange. • [Get Threat Data Object Additional Details](https://ctixapiv3.cyware.com/threat-data-objects/basic-details/threat-data-object-advanced-details.md): Retrieves additional information about a threat data object, such as kill chain phases and published collections. • [Get Kill Chain Phases List](https://ctixapiv3.cyware.com/threat-data-objects/basic-details/list-kill-chain-phases.md): Retrieves kill chain phases associated with a threat data object. • [Get Kill Chain Details](https://ctixapiv3.cyware.com/threat-data-objects/basic-details/kill-chain-details.md): Retrieves the details of a STIX kill chain phase. • [Get Published Collections of a Threat Object List](https://ctixapiv3.cyware.com/threat-data-objects/basic-details/list-published-collections-of-a-threat-object.md): Retrieves the collections to which a threat data object is published. • [Get Threat Data Object Details in Table View](https://ctixapiv3.cyware.com/threat-data-objects/basic-details/threat-data-object-details-in-table-view.md): Retrieves the object information for the given filters in a tabular format. • [Get Threat Data Object Sources List](https://ctixapiv3.cyware.com/threat-data-objects/basic-details/list-threat-data-object-sources.md): Retrieves a list of feed sources associated with a threat data object. Also, retrieves the description, fanged description, and de-fanged description of the sources. • [Get Source Details List](https://ctixapiv3.cyware.com/threat-data-objects/basic-details/list-source-details.md): Retrieves source information for a threat data object. • [Get Object Source Details in List View](https://ctixapiv3.cyware.com/threat-data-objects/basic-details/object-source-details-in-list-view.md): List all the instances when the object has been polled into the platform for the given source ID. • [Get Object Source Details](https://ctixapiv3.cyware.com/threat-data-objects/basic-details/object-source-details.md): Retrieves the source object information for the specified threat data object. • [Get Source External References List](https://ctixapiv3.cyware.com/threat-data-objects/basic-details/list-source-external-references.md): Retrieves a list of the external references that are associated with STIX SDOs. • [Add Custom Aliases to Threat Actors](https://ctixapiv3.cyware.com/threat-data-objects/basic-details/add-custom-aliases.md): Add custom aliases to threat actors in Intel Exchange. • [Confidence Score (Risk Score)](https://ctixapiv3.cyware.com/threat-data-objects/confidence-score.md): A confidence score is a value between 0 and 100 assigned automatically to threat indicators and represents the confidence that the scoring engine has in that indicator being malicious. A higher score indicates a more malicious indicator. For more information, see Intel Exchange Confidence Score Engine . • [Refresh Confidence Score (Risk Score)](https://ctixapiv3.cyware.com/threat-data-objects/confidence-score/refresh-confidence-score.md): Returns the Confidence Score (Risk Score) of an indicator threat data object. • [Get Key Evidence of Confidence Score (Risk Score)](https://ctixapiv3.cyware.com/threat-data-objects/confidence-score/retrieve-key-evidence-of-confidence-score.md): Retrieve the key evidence for the Confidence Score (Risk Score) calculation for an indicator. • [Custom Attributes](https://ctixapiv3.cyware.com/threat-data-objects/custom-attributes.md): Custom Attributes provide additional information that enhances the details of threat intelligence. These attributes are not limited to specific types or categories and can be customized based on the unique requirements of security and business operations. • [Get Custom Attributes List of Threat Data Object](https://ctixapiv3.cyware.com/threat-data-objects/custom-attributes/list-custom-attributes-of-threat-data-object.md): Retrieves the custom attributes of a threat data object with respect to all the sources the object has received. • [Relations](https://ctixapiv3.cyware.com/threat-data-objects/relations.md): The Relations section in the Threat Data module provides comprehensive information on the relationship details of a threat data object. • [Get Relations Overview](https://ctixapiv3.cyware.com/threat-data-objects/relations/relations-overview.md): Retrieves the overall statistics for all relations of a threat data object. • [Get Relations List](https://ctixapiv3.cyware.com/threat-data-objects/relations/list-relations.md): Retrieves the related statistics for the given object type and object ID. • [Get Relations List of Threat Data Object](https://ctixapiv3.cyware.com/threat-data-objects/relations/list-relations-of-threat-data-object.md): Retrieves the list of related objects and the relation details of a threat data object. • [Filter Relations by Source](https://ctixapiv3.cyware.com/threat-data-objects/relations/filter-relations-by-source.md): Retrieves source-specific relations of a threat data object. • [Enrichment](https://ctixapiv3.cyware.com/threat-data-objects/enrichment.md): Intel Exchange offers you to enrich a threat data object directly from the Threat Data module. This section contains the API related to enriching a threat data object from the Threat Data module. • [Get Enriched Threat Data](https://ctixapiv3.cyware.com/threat-data-objects/enrichment/enrich-threat-data.md): Returns the enriched data of a threat data object using enrichment tools. • [Actions](https://ctixapiv3.cyware.com/threat-data-objects/actions.md): Actions module retrieves the details about the actions performed on a threat data object. • [Get Actions List](https://ctixapiv3.cyware.com/threat-data-objects/actions/list-actions.md): Retrieves a list of actions performed on a threat data object. • [Get Action Statistics](https://ctixapiv3.cyware.com/threat-data-objects/actions/action-statistics.md): Retrieves the statistics of the actions performed by third-party tools and Intel Exchange on a threat data object. • [Get Action Overview](https://ctixapiv3.cyware.com/threat-data-objects/actions/action-overview.md): Retrieves an overview of actions performed on a threat data object. • [Tasks](https://ctixapiv3.cyware.com/threat-data-objects/tasks.md): Tasks are the actions taken by analysts to respond to threats for containment, proactive prevention, or remediation. You can create tasks in the individual modules, individual threat data elements, and in the global task module as well. • [Get Tasks List in Threat Data Object](https://ctixapiv3.cyware.com/threat-data-objects/tasks/list-tasks-in-threat-data-object.md): Returns the list of tasks associated with a threat data object. • [Get Task Details](https://ctixapiv3.cyware.com/threat-data-objects/tasks/task-details.md): Returns the details of a task. • [Create Task in Threat Data Object](https://ctixapiv3.cyware.com/threat-data-objects/tasks/create-task-in-threat-data-object.md): Creates a task for the specified threat data object. • [Update Task](https://ctixapiv3.cyware.com/threat-data-objects/tasks/update-task.md): Updates the details of a task. • [Delete Task](https://ctixapiv3.cyware.com/threat-data-objects/tasks/delete-task.md): Deletes a task from the Intel Exchange platform. • [Get Task Overview in Threat Data Object](https://ctixapiv3.cyware.com/threat-data-objects/tasks/task-overview-in-threat-data-object.md): Returns an overview of the tasks created for a threat data object. • [Create Task in Multiple Objects](https://ctixapiv3.cyware.com/threat-data-objects/tasks/create-task-in-multiple-objects.md): Creates a task in multiple threat data objects. • [Notes](https://ctixapiv3.cyware.com/threat-data-objects/notes.md): Notes include additional information of a threat data object that the analysts want to share with internal teams and tenants. Using notes, you can share indicators, threat intel data, threat data details, actionable tasks, or any other details. • [Get Notes List in Threat Data Object](https://ctixapiv3.cyware.com/threat-data-objects/notes/list-notes-in-threat-data-object.md): Returns a list of notes associated with a threat data object. • [Get Note Details in Threat Data Object](https://ctixapiv3.cyware.com/threat-data-objects/notes/note-details.md): Returns the details of a note. • [Add Note to Threat Data Object](https://ctixapiv3.cyware.com/threat-data-objects/notes/add-note-to-threat-data-object.md): Adds a note to a threat data object. • [Update Note](https://ctixapiv3.cyware.com/threat-data-objects/notes/update-note.md): Updates the details of a note. • [Delete Note](https://ctixapiv3.cyware.com/threat-data-objects/notes/delete-note.md): Deletes a note by its unique ID. • [Quick Action](https://ctixapiv3.cyware.com/threat-data-objects/quick-action.md): Intel Exchange offers to perform various quick actions, such as deprecating, marking false-positive, reviewing, revoking, and more on a threat data element. This module contains APIs related to quick actions. • [Get Quick Action Details](https://ctixapiv3.cyware.com/threat-data-objects/quick-action/quick-action-details.md): Returns the status of the quick actions performed on a threat data object. • [Perform Action on Threat Data Object](https://ctixapiv3.cyware.com/threat-data-objects/quick-action/perform-action-on-threat-data-object.md): Performs an action on a threat data object. You can perform actions such as deprecate, undeprecate, add analyst TLP, add analyst score, and more • [Threat Mailbox](https://ctixapiv3.cyware.com/threat-mailbox.md): Intel Exchange offers Threat Mailbox to receive threat intel feeds from multiple email accounts. Intel Exchange fetches intel from the attachments, email content, and password protected attachments. For more information, see Threat Mailbox . • [Get Emails List](https://ctixapiv3.cyware.com/threat-mailbox/list-emails.md): Returns a list of email messages received from email feed sources. • [Get Email Details](https://ctixapiv3.cyware.com/threat-mailbox/email-details.md): Returns the details of an email. • [Get Attachments List](https://ctixapiv3.cyware.com/threat-mailbox/list-attachments.md): Returns a list of attachments of an email message. • [Download All Threat Mail Attachments](https://ctixapiv3.cyware.com/threat-mailbox/download-all-attachments.md): Use this API to download all the attachments of an email message. • [Download Single Threat Mail Attachment](https://ctixapiv3.cyware.com/threat-mailbox/download-single-attachment.md): Use this API to download one attachment of an email message. • [Get Search URL](https://ctixapiv3.cyware.com/threat-mailbox/search-url.md): Search URLs in email messages. • [Update Email Message](https://ctixapiv3.cyware.com/threat-mailbox/update-email-message.md): Use this API to update the details of an email message. • [Get IOCs Count](https://ctixapiv3.cyware.com/threat-mailbox/iocs-count.md): Returns the number of IOCs in the email body and email attachments. • [Get IOCs Listing](https://ctixapiv3.cyware.com/threat-mailbox/iocs-listing.md): Returns a list of IOCs and attachments in an email. • [Create Intel from Email](https://ctixapiv3.cyware.com/threat-mailbox/create-intel-from-email.md): Creates intel from Threat Mailbox emails in Intel Exchange. • [Threat Bulletin](https://ctixapiv3.cyware.com/threat-bulletin.md): Threat Bulletin is a summary of recent activities, emerging trends, or research analysis data that can help your organization to keep pace with the evolving cyber threat landscape. For more information, see Threat Bulletin . • [Create Threat Bulletin](https://ctixapiv3.cyware.com/threat-bulletin/create-threat-bulletin.md): Creates a threat bulletin. • [Update Threat Bulletin](https://ctixapiv3.cyware.com/threat-bulletin/update-threat-bulletin.md): Updates the threat bulletin. • [Get Threat Bulletin List](https://ctixapiv3.cyware.com/threat-bulletin/list-threat-bulletins.md): Returns a list of threat bulletins with details. • [Get Threat Bulletin Details](https://ctixapiv3.cyware.com/threat-bulletin/threat-bulletin-details.md): Returns the details of a threat bulletin. • [Send Email](https://ctixapiv3.cyware.com/threat-bulletin/send-email.md): Sends the threat bulletin to internal and external recipients through email. • [Get Token to Download Attachment](https://ctixapiv3.cyware.com/threat-bulletin/token-to-download-attachment.md): Returns the token to download the attachments of a threat bulletin. • [Download Threat Bulletin Attachment](https://ctixapiv3.cyware.com/threat-bulletin/download-attachment.md): Downloads an attachment from a threat bulletin. • [Get Threat Bulletin Attachments List](https://ctixapiv3.cyware.com/threat-bulletin/list-threat-bulletin-attachments.md): Returns all attachments of one threat bulletin. • [RSS Feeds](https://ctixapiv3.cyware.com/rss-feeds.md): Rich Site Summary (RSS) web feeds contain a summary of updates from a website, often in the form of a list of articles with links, in a computer-readable format. These feeds help you stay up-to-date about threat intelligence updates. For more information, see RSS Feeds . • [Get RSS Feed Articles List](https://ctixapiv3.cyware.com/rss-feeds/list-rss-feed-articles.md): Returns a list of articles from RSS feed sources. • [Update RSS Feed Article](https://ctixapiv3.cyware.com/rss-feeds/update-rss-feed-article.md): Updates an RSS feed article. • [Get IOCs Listing](https://ctixapiv3.cyware.com/rss-feeds/iocs-listing-1.md): Returns the IOCs of an RSS article. • [Create Intel from RSS Feed](https://ctixapiv3.cyware.com/rss-feeds/create-intel-from-rss-feed.md): Creates intel from the IOCs of an RSS article. • [Global Notes](https://ctixapiv3.cyware.com/global-notes.md): Notes include additional information about a threat data object that the analysts want to share with internal teams and tenants. Using notes, you can share indicators, threat intel data, threat data details, actionable tasks, or any other details. For more information, see Global Notes . • [Get Notes List](https://ctixapiv3.cyware.com/global-notes/list-notes.md): This API endpoint retrieves a list of global notes. • [Get Note Details](https://ctixapiv3.cyware.com/global-notes/note-details-1.md): This API endpoint retrieves the details of a specific note identified by the note_id . • [Add Note](https://ctixapiv3.cyware.com/global-notes/add-note.md): Adds a note to a threat data object. • [Update Note](https://ctixapiv3.cyware.com/global-notes/update-note.md): Updates the details of a note. • [Delete Note](https://ctixapiv3.cyware.com/global-notes/delete-note.md): Deletes a note by its unique ID. • [Bulk Note](https://ctixapiv3.cyware.com/global-notes/bulk-note.md): Creates notes in bulk for multiple threat data objects. • [Threat Investigation](https://ctixapiv3.cyware.com/threat-investigation.md): Threat Investigations in Intel Exchange helps you to investigate security threats with improved insights on a visual canvas. You can use the interactive graphical visualization canvas to analyze threat data. For more information, see Threat Investigation . • [Threat Data](https://ctixapiv3.cyware.com/threat-investigation/threat-data.md): This section includes the APIs to retrieve threat data object details to use in threat investigations. • [Get Threat Data List](https://ctixapiv3.cyware.com/threat-investigation/threat-data/list-threat-data-1.md): Returns a list of threat data objects that are accessible to use in the threat investigations canvas. • [Get Nominal Threat Data List](https://ctixapiv3.cyware.com/threat-investigation/threat-data/list-nominal-threat-data.md): Returns a list of threat data objects that are accessible to use in the threat investigations canvas with limited details of the objects. • [Get Threat Data Object Details](https://ctixapiv3.cyware.com/threat-investigation/threat-data/threat-data-object-details.md): Returns the details of a threat data object that is accessible from the Threat Investigation canvas. • [Enrichment](https://ctixapiv3.cyware.com/threat-investigation/enrichment.md): Use the API in this section to get perform enrichment on threat data from the threat investigations module. • [Analyze Relations](https://ctixapiv3.cyware.com/threat-investigation/enrichment/analyze-relations.md): Returns relationship details of threat data objects within Intel Exchange. • [Enrich Nodes](https://ctixapiv3.cyware.com/threat-investigation/enrichment/enrich-nodes.md): Enrich threat data objects for threat investigation using third-party enrichment tools configured in Intel Exchange. • [Relationship](https://ctixapiv3.cyware.com/threat-investigation/relationship.md): Use the API in this section to gain an understanding of the relationship types between any two STIX 2.1 objects or two threat data objects. • [Get Possible Relationships List](https://ctixapiv3.cyware.com/threat-investigation/relationship/list-possible-relationships.md): Returns the list of possible STIX 2.1 relationship types that can exist between two STIX Domain Objects. • [List Existing Relationships](https://ctixapiv3.cyware.com/threat-investigation/relationship/list-existing-relationships.md): Returns the relationship types that exist between two threat data objects. • [Publishing](https://ctixapiv3.cyware.com/threat-investigation/publishing.md): Use the APIs in this section to publish the intel, create a draft, and view intel publishing history in threat investigations. • [Create Intel](https://ctixapiv3.cyware.com/threat-investigation/publishing/create-intel.md): Creates a report object from the details retrieved from the threat investigation. • [Create Draft](https://ctixapiv3.cyware.com/threat-investigation/publishing/create-draft.md): Creates intel in the draft state from the details retrieved from the threat investigation. • [Get Intel History Investigations](https://ctixapiv3.cyware.com/threat-investigation/publishing/intel-history-investigations.md): Returns the intel creation history of threat investigations. • [Canvas](https://ctixapiv3.cyware.com/threat-investigation/canvas.md): This section contains APIs related to the threat investigation canvas • [Get Canvases List](https://ctixapiv3.cyware.com/threat-investigation/canvas/list-canvases.md): Returns a list of canvases. • [Get Canvas Basic Details](https://ctixapiv3.cyware.com/threat-investigation/canvas/canvas-basic-details.md): Return the details of a canvas. • [Get Canvas Nodes Details](https://ctixapiv3.cyware.com/threat-investigation/canvas/canvas-nodes-details.md): Returns the node details of a threat investigation canvas. • [ATT&CK Navigator](https://ctixapiv3.cyware.com/att-and-ck-navigator.md): The MITRE ATT&CK Navigator is a web-based tool for annotating and exploring ATT&CK matrices. It can be used to visualize defensive coverage, red/blue team planning, the frequency of detected techniques, and more. Navigator tactics include various strategies used by the threat actors, whereas techniques define the way of achieving the strategies. For more information, see ATT&CK Navigator . • [ATT&CK Layer](https://ctixapiv3.cyware.com/att-and-ck-navigator/att-and-ck-layer.md): The Intel Exchange ATT&CK Navigator enables you to clone and manage multiple layers based on the MITRE or Custom Base Layer . The layers constitute tactics and techniques used to track and monitor specific adversaries and platforms. You can browse, select, and add the set of techniques and custom techniques to match the particular criteria for specific projects. • [Get ATT&CK Layers List](https://ctixapiv3.cyware.com/att-and-ck-navigator/att-and-ck-layer/list-att-and-ck-layers.md): Returns a list of custom ATT&CK layers. • [Get ATT&CK Layer Details](https://ctixapiv3.cyware.com/att-and-ck-navigator/att-and-ck-layer/att-and-ck-layer-details.md): Returns the details of a custom ATT&CK layer. • [Techniques](https://ctixapiv3.cyware.com/att-and-ck-navigator/techniques.md): ATT&CK Navigator techniques define the way of achieving the strategies. This section includes APIs to manage ATT&CK Navigator techniques. • [Get ATT&CK Techniques List](https://ctixapiv3.cyware.com/att-and-ck-navigator/techniques/list-att-and-ck-techniques.md): Returns a list of ATT&CK techniques. • [Get Technique Details](https://ctixapiv3.cyware.com/att-and-ck-navigator/techniques/technique-details.md): Returns the details of a technique. • [Get Sub-techniques List](https://ctixapiv3.cyware.com/att-and-ck-navigator/techniques/list-sub-techniques.md): Returns details of all the sub-techniques. • [Get Sub-technique Details](https://ctixapiv3.cyware.com/att-and-ck-navigator/techniques/sub-technique-details.md): Returns the details of a sub-technique. • [Get Relation List](https://ctixapiv3.cyware.com/att-and-ck-navigator/techniques/relation-list.md): Returns a list of threat data objects related to a technique. • [Get References](https://ctixapiv3.cyware.com/att-and-ck-navigator/techniques/references.md): Returns the references of an attack technique. • [Get Tactics](https://ctixapiv3.cyware.com/att-and-ck-navigator/tactics.md): Returns a list of ATT&CK tactics. • [Get Filters](https://ctixapiv3.cyware.com/att-and-ck-navigator/filters.md): Returns the filter options of various filters available for ATT&CK Navigator. • [Get IOC Heat Map](https://ctixapiv3.cyware.com/att-and-ck-navigator/ioc-heat-map.md): Returns relation statistics for the IOC heat map. • [Fang/Defang](https://ctixapiv3.cyware.com/fang-defang.md): Use Fang-Defang to neutralize malicious information with an obfuscated representation so that it is not dangerous if this information is inadvertently clicked or automatically processed in error. For more information, see Use Fang/Defang . • [Fang/Defang Indicators](https://ctixapiv3.cyware.com/fang-defang/fang-defang-indicators.md): Convert fanged data into defanged format and vice versa. If categorize = true is passed in the request parameters, then the response includes the IOC types and the fanged or defanged data as key-value pairs. • [Rules](https://ctixapiv3.cyware.com/rules.md): Rules are a predefined set of instructions that can perform automated tasks when a defined situation or condition occurs. For more information, see Automation Rules . • [Save Result Set](https://ctixapiv3.cyware.com/rules/save-result-set.md): Save Result Set is a specification in Intel Exchange that is designed to make Intel Exchange data available over a web service such as OpenAPI. Use Rules on Intel Exchange to make indicators available over the Save Result Set. • [Get Saved Result Set Data](https://ctixapiv3.cyware.com/rules/save-result-set/retrieve-saved-result-set-data.md): Returns the data published to the Saved Result Set using rules. • [Get Rules List](https://ctixapiv3.cyware.com/rules/list-rules.md): Retrieves a list of rules from the platform. • [Get Rules List with Minimal Details](https://ctixapiv3.cyware.com/rules/list-rules-with-minimal-details.md): Returns a list of rules with the ID and name of the rules only. • [Get Rule Details](https://ctixapiv3.cyware.com/rules/rule-details.md): Retrieves the details of a rule. • [Update Rule](https://ctixapiv3.cyware.com/rules/update-rule.md): Update specific details of a rule. • [Follow or Unfollow Rule](https://ctixapiv3.cyware.com/rules/follow-or-unfollow-rule.md): Enables you to follow or unfollow a rule. • [Run Rule](https://ctixapiv3.cyware.com/rules/run-rule.md): Runs a rule asynchronously on the existing threat data created in the specified time interval. • [Bulk Action on Rules](https://ctixapiv3.cyware.com/rules/bulk-action-on-rules.md): Updates multiple rules in one operation. • [Global Tasks](https://ctixapiv3.cyware.com/global-tasks.md): Tasks are the actions taken by analysts to respond to threats for containment, proactive prevention, or remediation. You can create tasks in the individual modules, individual threat data elements, and in the global task module as well. For more information, see Global Tasks . • [Get Tasks List](https://ctixapiv3.cyware.com/global-tasks/list-tasks.md): Returns a list of global tasks. • [Get Task Details](https://ctixapiv3.cyware.com/global-tasks/task-details-1.md): Returns the details of a task. • [Create Task](https://ctixapiv3.cyware.com/global-tasks/create-task.md): Creates a task for a threat data object. • [Update Task](https://ctixapiv3.cyware.com/global-tasks/update-task.md): Updates the details of a task. • [Delete Task](https://ctixapiv3.cyware.com/global-tasks/delete-task.md): Deletes a task from the Intel Exchange platform. • [Get Task Overview in Threat Data Object](https://ctixapiv3.cyware.com/global-tasks/task-overview-in-threat-data-object-1.md): Returns an overview of the tasks created for a threat data object. • [Create Task in Multiple Objects](https://ctixapiv3.cyware.com/global-tasks/create-task-in-multiple-objects.md): Creates a task in multiple threat data objects. • [Detailed Submission](https://ctixapiv3.cyware.com/detailed-submission.md): Analysts can create detailed threat intel and publish intel to their subscribers in Intel Exchange by submitting detailed information for the supported STIX objects. For more information, see Detailed Submission . • [Common](https://ctixapiv3.cyware.com/detailed-submission/common.md): Folder contains the common APIs that the STIX form component uses to serve static data. • [Get Vocabulary List](https://ctixapiv3.cyware.com/detailed-submission/common/list-vocabulary.md): Request to get the STIX 2.1 vocab. • [Get Relation List](https://ctixapiv3.cyware.com/detailed-submission/common/relation-list-1.md): Request to get the static information about the types of relationships that exists between different types of SODs. • [DRAFT](https://ctixapiv3.cyware.com/detailed-submission/draft.md): Contains the API calls for creating intel in DRAFT state. The following API calls in the folder are the first interaction the users have when creating intel using the STIX Forms. • [Create DRAFT Intel](https://ctixapiv3.cyware.com/detailed-submission/draft/create-draft-intel.md): Request to create/start a STIX form detailed submission, the API returns a unique Identifier that will be used for all the subsequent calls in the create intel/detailed submission. • [Update DRAFT Intel](https://ctixapiv3.cyware.com/detailed-submission/draft/update-draft-intel.md): Updates the detailed STIX form submission that the user initiated. • [Get DRAFT Intel](https://ctixapiv3.cyware.com/detailed-submission/draft/retrieve-draft-intel.md): Returns the STIX form that the user has initiated. • [Discard Draft API](https://ctixapiv3.cyware.com/detailed-submission/draft/discard-draft-api.md): Discards the draft STIX form that the user has initiated. • [Indicator](https://ctixapiv3.cyware.com/detailed-submission/indicator.md): Indicators represent information that identifies malicious activity, such as IP addresses, URLs, or file hashes, used to detect and respond to potential threats. • [Create indicator SDO](https://ctixapiv3.cyware.com/detailed-submission/indicator/create-indicator-sdo.md): Adds an Indicator SDO in the initiated detailed STIX form submission. • [Update Indicator SDO](https://ctixapiv3.cyware.com/detailed-submission/indicator/update-indicator-sdo.md): Updates an indicator SDO in the initiated detailed STIX form submission. • [Get Indicator SDO](https://ctixapiv3.cyware.com/detailed-submission/indicator/retrieve-indicator-sdo.md): Returns the indicator SDO that the user added in the detailed submission using the unique identifier. • [Get Indicator SDOs List](https://ctixapiv3.cyware.com/detailed-submission/indicator/list-indicator-sdo.md): Lists the indicator SDOs in a paginated response for the given ID of the detailed submission. • [Delete Indicator SDO](https://ctixapiv3.cyware.com/detailed-submission/indicator/delete-indicator-sdo.md): Deletes a particular SDO added to the detailed STIX form submission using the unique identifier of the SDO. • [Bulk Delete Indicator SDO](https://ctixapiv3.cyware.com/detailed-submission/indicator/bulk-delete-indicator-sdo.md): Bulk deletes SDOs that are added to the detailed submission using the unique identifiers of the SDO. • [Delete All Indicator SDO](https://ctixapiv3.cyware.com/detailed-submission/indicator/delete-all-indicator-sdo.md): Deletes all SDOs added to the detailed STIX form submission. • [Attack Pattern](https://ctixapiv3.cyware.com/detailed-submission/attack-pattern.md): Attack patterns are a type of Tactics, Techniques, and Procedures (TTP) that describes ways that adversaries attempt to compromise targets. • [Create Attack Pattern SDO](https://ctixapiv3.cyware.com/detailed-submission/attack-pattern/create-attack-pattern-sdo.md): Adds an attack pattern SDO in the initiated detailed STIX form submission. • [Get Attack Pattern SDOs List](https://ctixapiv3.cyware.com/detailed-submission/attack-pattern/list-attack-pattern-sdo.md): List the attack pattern SDOs in a paginated response added under the given ID of the detailed STIX form submission. • [Update Attack Pattern SDO](https://ctixapiv3.cyware.com/detailed-submission/attack-pattern/update-attack-pattern-sdo.md): Updates the attack pattern SDO in the initiated detailed STIX form submission. • [Get Attack Pattern SDO](https://ctixapiv3.cyware.com/detailed-submission/attack-pattern/retrieve-attack-pattern-sdo.md): Returns an attack pattern SDO in the initiated detailed STIX form submission using the unique identifier of the attack pattern and the detailed submission. • [Delete Attack Pattern SDO](https://ctixapiv3.cyware.com/detailed-submission/attack-pattern/delete-attack-pattern-sdo.md): Deletes a particular SDO added to the detailed STIX form submission using the unique identifier of the SDO. • [Bulk Delete Attack Pattern SDO](https://ctixapiv3.cyware.com/detailed-submission/attack-pattern/bulk-delete-attack-pattern-sdo.md): Bulk deletes particular SDOs added to the detailed STIX form submission using the unique identifiers of the SDO. • [Delete All Attack Pattern SDO](https://ctixapiv3.cyware.com/detailed-submission/attack-pattern/delete-all-attack-pattern-sdo.md): Deletes all SDOs added to the detailed STIX form submission. • [Malware](https://ctixapiv3.cyware.com/detailed-submission/malware.md): Malware is harmful software used by attackers to gain access, damage systems, or steal data. It includes things like viruses, worms, and ransomware. • [Create Malware SDO](https://ctixapiv3.cyware.com/detailed-submission/malware/create-malware-sdo.md): Adds a malware SDO in the initiated detailed STIX form submission. • [Update Malware SDO](https://ctixapiv3.cyware.com/detailed-submission/malware/update-malware-sdo.md): Updates a malware SDO in the initiated detailed STIX form submission. • [Get Malware SDO](https://ctixapiv3.cyware.com/detailed-submission/malware/retrieve-malware-sdo.md): Retrieves a malware SDO in the initiated detailed STIX form submission using its unique identifier. • [Get Malware SDOs List](https://ctixapiv3.cyware.com/detailed-submission/malware/list-malware-sdo.md): Lists the SDOs added under the given ID of the detailed STIX form submission in a paginated response. • [Delete Malware SDO](https://ctixapiv3.cyware.com/detailed-submission/malware/delete-malware-sdo.md): Deletes a particular SDO added to the detailed STIX form submission using the unique identifier of the SDO. • [Bulk Delete Malware SDO](https://ctixapiv3.cyware.com/detailed-submission/malware/bulk-delete-malware-sdo.md): Bulk deletes a particular SDO added to the detailed STIX form submission using the unique identifiers of the SDO. • [Delete All Malware SDO](https://ctixapiv3.cyware.com/detailed-submission/malware/delete-all-malware-sdo.md): Deletes all SDOs added to the detailed STIX form submission. • [SCOs](https://ctixapiv3.cyware.com/detailed-submission/scos.md): SCO defines a set of one or more properties named ID Contributing Properties . These properties may be used in the default calculation of the ID when creating an SCO. In some cases, an additional selection of extension properties that contribute to the ID may be described in the ID Contributing Properties section listed on each SCO. • [Create IPv4-addr SCO](https://ctixapiv3.cyware.com/detailed-submission/scos/create-ipv4-addr-sco.md): Creates an IPv4 SCO in a detailed STIX form submission. • [Create IPv6-addr SCO](https://ctixapiv3.cyware.com/detailed-submission/scos/create-ipv6-addr-sco.md): Creates an IPv6 SCO in the detailed STIX form submission. • [Create URL SCO](https://ctixapiv3.cyware.com/detailed-submission/scos/create-url-sco.md): Creates a URL SCO in the detailed STIX form submission. • [Create Domain Name SCO](https://ctixapiv3.cyware.com/detailed-submission/scos/create-domain-name-sco.md): Creates a domain SCO in the detailed STIX form submission. • [Create Email-addr SCO](https://ctixapiv3.cyware.com/detailed-submission/scos/create-email-addr-sco.md): Create an email address SCO in the detailed STIX form submission. • [Create File SCO](https://ctixapiv3.cyware.com/detailed-submission/scos/create-file-sco.md): Creates a file SCO in the detailed STIX form submission. • [Create Mutex SCO](https://ctixapiv3.cyware.com/detailed-submission/scos/create-mutex-sco.md): Creates a mutex SCO in the detailed STIX form submission. • [Create Email Message SCO](https://ctixapiv3.cyware.com/detailed-submission/scos/create-email-message-sco.md): Creates an email message SCO in the detailed STIX form submission. • [Create Software SCO](https://ctixapiv3.cyware.com/detailed-submission/scos/create-software-sco.md): Creates a software SCO in the detailed STIX form submission. • [Relationship](https://ctixapiv3.cyware.com/detailed-submission/relationship.md): The Relationship object is used to link together two SDOs or SCOs in order to describe how they are related to each other. If SDOs and SCOs are considered nodes or vertices in the graph, the Relationship Objects (SROs) represent edges. • [Create Relationship SDO](https://ctixapiv3.cyware.com/detailed-submission/relationship/create-relationship-sdo.md): Adds relation SRO in the initiated detailed STIX form submission. • [Update Relationship SDO](https://ctixapiv3.cyware.com/detailed-submission/relationship/update-relationship-sdo.md): Updates the relation SDO in the initiated detailed STIX form submission. • [Get Relationship SDO](https://ctixapiv3.cyware.com/detailed-submission/relationship/retrieve-relationship-sdo.md): Returns the SDO relation that is added in the detailed submission using the relation's unique identifier. • [Get Relationship SDOs List](https://ctixapiv3.cyware.com/detailed-submission/relationship/list-relationship-sdo.md): Lists the relationship SDOs added under the given ID of the detailed STIX form submission in a paginated response. • [Delete Relationship SDO](https://ctixapiv3.cyware.com/detailed-submission/relationship/delete-relationship-sdo.md): Deletes a particular SDO added to the detailed STIX form submission using the unique identifier of the SDO. • [Bulk Delete Relationship SDOs](https://ctixapiv3.cyware.com/detailed-submission/relationship/bulk-delete-relationship-sdos.md): Bulk deletes a particular SDO added to the detailed STIX form submission using the unique identifiers of the SDO. • [Delete All Relationship SDO](https://ctixapiv3.cyware.com/detailed-submission/relationship/delete-all-relationship-sdo.md): Deletes all SDOs added to the detailed STIX form submission. • [Sighting](https://ctixapiv3.cyware.com/detailed-submission/sighting.md): A Sighting denotes the belief that something in CTI (e.g., an indicator, malware, tool, threat actor, etc.) was seen. Sightings are used to track who and what are being targeted, how attacks are carried out, and to track trends in attack behavior. • [Update Sighting SDO](https://ctixapiv3.cyware.com/detailed-submission/sighting/update-sighting-sdo.md): Updates sighting SDO in the initiated detailed submission. • [Get Sighting SDO](https://ctixapiv3.cyware.com/detailed-submission/sighting/retrieve-sighting-sdo.md): Retrieves the SDO relation that is added in the detailed submission using the relation unique identifier. • [Get Sighting SDOs List](https://ctixapiv3.cyware.com/detailed-submission/sighting/list-sighting-sdo.md): Lists the SDOs added under the given ID of the detailed STIX form submission in a paginated response. • [Delete Sighting SDO](https://ctixapiv3.cyware.com/detailed-submission/sighting/delete-sighting-sdo.md): Deletes a particular SDO added to the detailed STIX form submission using the unique identifier of the SDO. • [Bulk Delete Sighting SDO](https://ctixapiv3.cyware.com/detailed-submission/sighting/bulk-delete-sighting-sdo.md): Bulk deletes a particular SDO added to the detailed STIX form submission using the unique identifiers of the SDO. • [Delete All Sighting SDO](https://ctixapiv3.cyware.com/detailed-submission/sighting/delete-all-sighting-sdo.md): Deletes all SDOs added to the detailed STIX form submission. • [Campaign](https://ctixapiv3.cyware.com/detailed-submission/campaign.md): A Campaign is a grouping of adversarial behaviors that describes a set of malicious activities or attacks (sometimes called waves) that occur over a period of time against a specific set of targets. Campaigns usually have well defined objectives and may be part of an Intrusion Set. • [Create Campaign SDO](https://ctixapiv3.cyware.com/detailed-submission/campaign/create-campaign-sdo.md): Adds the campaign SDO to the initiated detailed submission. • [Update Campaign SDO](https://ctixapiv3.cyware.com/detailed-submission/campaign/update-campaign-sdo.md): Updates the campaign SDO in the initiated detailed submission. • [Get Campaign SDO](https://ctixapiv3.cyware.com/detailed-submission/campaign/retrieve-campaign-sdo.md): Returns the SDO added in the detailed submission using the campaign's unique identifier. • [Get Campaign SDOs List](https://ctixapiv3.cyware.com/detailed-submission/campaign/list-campaign-sdos.md): Lists the SDOs added under the given ID of the detailed STIX form submission in a paginated response. • [Delete Campaign SDO](https://ctixapiv3.cyware.com/detailed-submission/campaign/delete-campaign-sdo.md): Deletes a particular SDO added to the detailed STIX form submission using the unique identifier of the SDO. • [Bulk Delete Campaign SDO](https://ctixapiv3.cyware.com/detailed-submission/campaign/bulk-delete-campaign-sdo.md): Bulk deletes a particular SDO added to the detailed STIX form submission using the unique identifiers of the SDO. • [Delete All Campaign SDO](https://ctixapiv3.cyware.com/detailed-submission/campaign/delete-all-campaign-sdo.md): Deletes all SDOs added to the detailed STIX form submission. • [Course Of Action](https://ctixapiv3.cyware.com/detailed-submission/course-of-action.md): A Course of Action is an action taken either to prevent an attack or to respond to an attack that is in progress. It may describe technical, automatable responses (applying patches, reconfiguring firewalls) but can also describe higher -evel actions like employee training or policy changes. For example, a course of action to mitigate a vulnerability could describe applying the patch that fixes it. The Course of Action SDO contains a textual description of the action; a reserved action property also serves as a placeholder for future inclusion of machine automatable courses of action. • [Create Course of Action SDO](https://ctixapiv3.cyware.com/detailed-submission/course-of-action/create-course-of-action-sdo.md): Adds a course of action SDO in the initiated detailed submission. • [Update Course of Action SDO](https://ctixapiv3.cyware.com/detailed-submission/course-of-action/update-course-of-action-sdo.md): Updates a Course of Action SDO in the initiated detailed submission. • [Get Course of Action SDO](https://ctixapiv3.cyware.com/detailed-submission/course-of-action/retrieve-course-of-action-sdo.md): Returns the SDO added in the detailed submission using the campaign's unique identifier. • [Get Course of Action SDOs List](https://ctixapiv3.cyware.com/detailed-submission/course-of-action/list-sdos-course-of-action.md): Lists the SDOs added under the given ID of the detailed STIX form submission in a paginated response. • [Delete Course of Action SDO](https://ctixapiv3.cyware.com/detailed-submission/course-of-action/delete-course-of-action-sdo.md): Deletes a particular SDO added to the detailed STIX form submission using the SDO's unique identifier. • [Bulk Delete Course of Action SDO](https://ctixapiv3.cyware.com/detailed-submission/course-of-action/bulk-delete-course-of-action-sdo.md): Bulk deletes a particular SDO added to the detailed STIX form submission using the unique identifiers of the SDO. • [Delete All Course of Action SDO](https://ctixapiv3.cyware.com/detailed-submission/course-of-action/delete-all-course-of-action-sdo.md): Deletes all SDOs added to the detailed STIX form submission. • [Identity](https://ctixapiv3.cyware.com/detailed-submission/identity.md): The Identity SDO can capture basic identifying information, contact information, and the sectors that the Identity belongs. Identity is used in STIX to represent, among other things, targets of attacks, information sources, object creators, and threat actor identities. • [Create Identity SDO](https://ctixapiv3.cyware.com/detailed-submission/identity/create-identity-sdo.md): Adds an Identity SDO in the initiated detailed STIX form submission. • [Update Identity SDO](https://ctixapiv3.cyware.com/detailed-submission/identity/update-identity-sdo.md): Updates an Identity SDO in the initiated detailed STIX form submission. • [Get Identity SDO](https://ctixapiv3.cyware.com/detailed-submission/identity/retrieve-identity-sdo.md): Returns the SDO added in the detailed STIX form submission using the identity's unique identifier. • [Get Identity SDOs List](https://ctixapiv3.cyware.com/detailed-submission/identity/list-identity-sdo.md): Lists the SDOs added under the given ID of the detailed STIX form submission in a paginated response. • [Delete Identity SDO](https://ctixapiv3.cyware.com/detailed-submission/identity/delete-identity-sdo.md): Deletes a particular SDO added to the detailed STIX form submission using the unique identifier of the SDO. • [Bulk Delete Identity SDO](https://ctixapiv3.cyware.com/detailed-submission/identity/bulk-delete-identity-sdo.md): Bulk deletes a particular SDO added to the detailed STIX form submission using the unique identifiers of the SDO. • [Delete All Identity SDO](https://ctixapiv3.cyware.com/detailed-submission/identity/delete-all-identity-sdo.md): Deletes all SDOs added to the detailed STIX form submission. • [Location](https://ctixapiv3.cyware.com/detailed-submission/location.md): The Location SDO is related to an Identity or Intrusion Set to indicate that the identity or intrusion set is located in that location. It is also related to a malware or attack pattern to indicate that they target victims in that location. The Location object describes geographic areas, not governments, even in cases where that area might have a government. For example, a Location representing the United States describes the United States as a geographic area, not the federal government of the United States. • [Create Location SDO](https://ctixapiv3.cyware.com/detailed-submission/location/create-location-sdo.md): Adds a location SDO in the initiated detailed STIX form submission. • [Update Location SDO](https://ctixapiv3.cyware.com/detailed-submission/location/update-location-sdo.md): Updates a location SDO in the initiated detailed STIX form submission. • [Get Location SDO](https://ctixapiv3.cyware.com/detailed-submission/location/retrieve-location-sdo.md): Returns the SDO location added in the detailed STIX form submission using the location's unique identifier. • [Get Location SDOs List](https://ctixapiv3.cyware.com/detailed-submission/location/list-location-sdo.md): Lists the SDOs added under the given ID of the detailed STIX form submission in a paginated response. • [Delete Location SDO](https://ctixapiv3.cyware.com/detailed-submission/location/delete-location-sdo.md): Deletes a particular SDO added to the detailed STIX form submission using the unique identifier of the SDO. • [Bulk Delete Location SDO](https://ctixapiv3.cyware.com/detailed-submission/location/bulk-delete-location-sdo.md): Bulk deletes a particular SDO added to the detailed STIX form submission using the unique identifiers of the SDO. • [Delete All Location SDO](https://ctixapiv3.cyware.com/detailed-submission/location/delete-all-location-sdo.md): Deletes all SDOs added to the detailed STIX form submission. • [Infrastructure](https://ctixapiv3.cyware.com/detailed-submission/infrastructure.md): Infrastructure refers to the physical components of interrelated systems providing commodities and services essential to enable, sustain, or enhance societal living conditions. Infrastructure can be fundamental facilities and systems serving a country, city, or other areas, including the services and facilities necessary for its economy to function. Infrastructure can also comprise public and private physical improvements such as roads, railways, bridges, tunnels, water supply, sewers, electrical grids, and telecommunications (including Internet connectivity and broadband speeds). • [Create Infrastructure SDO](https://ctixapiv3.cyware.com/detailed-submission/infrastructure/create-infrastructure-sdo.md): Adds the infrastructure SDO in the initiated detailed submission. • [Update Infrastructure SDO](https://ctixapiv3.cyware.com/detailed-submission/infrastructure/update-infrastructure-sdo.md): Updates the infrastructure SDO in the initiated detailed submission. • [Get Infrastructure SDO](https://ctixapiv3.cyware.com/detailed-submission/infrastructure/retrieve-infrastructure-sdo.md): Returns infrastructure SDO details as added in the detailed submission. • [Get Infrastructure SDOs List](https://ctixapiv3.cyware.com/detailed-submission/infrastructure/list-infrastructure-sdo.md): Lists the infrastructure SDOs added under the given ID of the detailed submission in a paginated response. • [Delete Infrastructure SDO](https://ctixapiv3.cyware.com/detailed-submission/infrastructure/delete-infrastructure-sdo.md): Deletes the particular SDO added to the detailed submission using the unique identifier of the SDO. • [Bulk Delete Infrastructure SDO](https://ctixapiv3.cyware.com/detailed-submission/infrastructure/bulk-delete-infrastructure-sdo.md): Deletes the particular SDO using bulk actions that are added to the detailed submission using the unique identifiers of the SDO. • [Delete All Infrastructure SDO](https://ctixapiv3.cyware.com/detailed-submission/infrastructure/delete-all-infrastructure-sdo.md): Deletes all Infrastructure SDOs added to the detailed intel submission. • [Threat Actor](https://ctixapiv3.cyware.com/detailed-submission/threat-actor.md): Threat actors are actual individuals, groups, or organizations that operate with malicious intent. Threat actors can be characterized by their motives, capabilities, goals, sophistication level, past activities, resources they have access to, and their role in the organization. • [Create Threat Actor SDO](https://ctixapiv3.cyware.com/detailed-submission/threat-actor/create-threat-actor-sdo.md): Adds a threat actor SDO in the initiated detailed submission. • [Update Threat Actor SDO](https://ctixapiv3.cyware.com/detailed-submission/threat-actor/update-threat-actor-sdo.md): Updates the threat actor SDO in the initiated detailed submission. • [Get Threat Actor SDO](https://ctixapiv3.cyware.com/detailed-submission/threat-actor/retrieve-threat-actor-sdo.md): Returns infrastructure SDO details as added in the detailed submission. • [Get Threat Actor SDOs List](https://ctixapiv3.cyware.com/detailed-submission/threat-actor/list-threat-actor-sdo.md): Lists the threat actor SDOs added under the given ID of the detailed submission in a paginated response. • [Delete Threat Actor SDO](https://ctixapiv3.cyware.com/detailed-submission/threat-actor/delete-threat-actor-sdo.md): Deletes the particular SDO added to the detailed submission using the unique identifier of the SDO. • [Bulk Delete Threat Actor SDO](https://ctixapiv3.cyware.com/detailed-submission/threat-actor/bulk-delete-threat-actor-sdo.md): Deletes the particular SDO using bulk actions that are added to the detailed submission using the unique identifiers of the SDO. • [Delete All Threat Actor SDO](https://ctixapiv3.cyware.com/detailed-submission/threat-actor/delete-all-threat-actor-sdo.md): Deletes all threat actor SDOs added to the detailed intel submission. • [Tool](https://ctixapiv3.cyware.com/detailed-submission/tool.md): The Tool threat data object characterizes the properties of these software tools and can be used as a basis for asserting how a threat actor uses them during an attack. It contains properties to name and describe the tool, a list of kill chain phases the tool is used to carry out, and the version of the tool. • [Create Tool SDO](https://ctixapiv3.cyware.com/detailed-submission/tool/create-tool-sdo.md): Adds the tool SDO to the initiated detailed submission. • [Update Tool SDO](https://ctixapiv3.cyware.com/detailed-submission/tool/update-tool-sdo.md): Updates the tool SDO in the initiated detailed STIX form submission. • [Get Tool SDO](https://ctixapiv3.cyware.com/detailed-submission/tool/retrieve-tool-sdo.md): Returns the SDO added in the detailed submission using the unique identifier. • [Get Tool SDOs List](https://ctixapiv3.cyware.com/detailed-submission/tool/list-tool-sdo.md): Lists the SDOs added under the given ID of the detailed STIX form submission in a paginated response. • [Delete Tool SDO](https://ctixapiv3.cyware.com/detailed-submission/tool/delete-tool-sdo.md): Deletes a particular SDO added to the detailed STIX form submission using the unique identifier of the SDO. • [Bulk Delete Tool SDO](https://ctixapiv3.cyware.com/detailed-submission/tool/bulk-delete-tool-sdo.md): Bulk deletes a particular SDO added to the detailed STIX form submission using the unique identifiers of the SDO. • [Delete All Tool SDO](https://ctixapiv3.cyware.com/detailed-submission/tool/delete-all-tool-sdo.md): Deletes all SDOs added to the detailed STIX form submission. • [Vulnerability](https://ctixapiv3.cyware.com/detailed-submission/vulnerability.md): A vulnerability is a weakness or a defect in the requirements, designs, or implementations of the computational logic found in software and some hardware components that can be directly exploited to negatively impact the confidentiality, integrity, or availability of that system. • [Create Vulnerability SDO](https://ctixapiv3.cyware.com/detailed-submission/vulnerability/create-vulnerability-sdo.md): Adds the vulnerability SDO in the initiated detailed submission. • [Update Vulnerability SDO](https://ctixapiv3.cyware.com/detailed-submission/vulnerability/update-vulnerability-sdo.md): Updates the vulnerability SDO in the initiated detailed STIX form submission. • [Get Vulnerability SDO](https://ctixapiv3.cyware.com/detailed-submission/vulnerability/retrieve-vulnerability-sdo.md): Returns the vulnerability SDO added in the detailed submission using the unique identifier. • [Get Vulnerability SDOs List](https://ctixapiv3.cyware.com/detailed-submission/vulnerability/list-vulnerability-sdo.md): Lists the SDOs added under the given ID of the detailed STIX form submission in a paginated response. • [Delete Vulnerability SDO](https://ctixapiv3.cyware.com/detailed-submission/vulnerability/delete-vulnerability-sdo.md): Deletes a particular SDO added to the detailed STIX form submission using the unique identifier of the SDO. • [Bulk Delete Vulnerability SDO](https://ctixapiv3.cyware.com/detailed-submission/vulnerability/bulk-delete-vulnerability-sdo.md): Bulk deletes a particular SDO added to the detailed STIX form submission using the unique identifiers of the SDO. • [Delete All Vulnerability SDO](https://ctixapiv3.cyware.com/detailed-submission/vulnerability/delete-all-vulnerability-sdo.md): Deletes all SDOs added to the detailed STIX form submission. • [Report](https://ctixapiv3.cyware.com/detailed-submission/report.md): Reports are collections of threat intelligence that may include descriptions of a threat actor, malware, or attack technique, including context and related details. They are used to group related threat intel items tied together so that they can be published as a comprehensive cyber threat story. The report component contains a list of references to STIX Objects (the CTI objects included in the report) along with a textual description and the name of the report. • [Create Report SDO](https://ctixapiv3.cyware.com/detailed-submission/report/create-report-sdo.md): Adds the report SDO to the initiated detailed submission. • [Update Report SDO](https://ctixapiv3.cyware.com/detailed-submission/report/update-report-sdo.md): API to update the report SDO in the initiated detailed submission. • [Get Report SDO](https://ctixapiv3.cyware.com/detailed-submission/report/retrive-report-sdo.md): Returns report SDO details as added in the detailed submission. • [Get Report SDOs List](https://ctixapiv3.cyware.com/detailed-submission/report/list-report-sdo.md): Lists the report SDOs added under the given ID of the detailed submission in a paginated response. • [Delete Report SDO](https://ctixapiv3.cyware.com/detailed-submission/report/delete-report-sdo.md): Deletes the particular SDO added to the detailed submission using the unique identifier of the SDO. • [Bulk Delete Report SDO](https://ctixapiv3.cyware.com/detailed-submission/report/bulk-delete-report-sdo.md): Deletes the particular SDO using bulk actions that are added to the detailed submission using the unique identifiers of the SDO. • [Delete All Report SDO](https://ctixapiv3.cyware.com/detailed-submission/report/delete-all-report-sdo.md): Deletes all report SDOs added to the detailed intel submission. • [Failure Logs](https://ctixapiv3.cyware.com/detailed-submission/failure-logs.md): Analysts can view logs with details of any failures that may occur while submitting intel in Intel Exchange using a threat bulletin or a detailed submission form. This helps analysts track their intel submissions and troubleshoot issues. • [Download Logs from Notification](https://ctixapiv3.cyware.com/detailed-submission/failure-logs/download-logs-from-notification.md): Download logs from the notification tab. • [Download Logs from Detailed Submission/Threat Bulletin](https://ctixapiv3.cyware.com/detailed-submission/failure-logs/download-logs-from-detailed-submission-threat-bulletin.md): Download logs from the Detailed Submission or Threat Bulletin page. • [Clone API for Partial Success](https://ctixapiv3.cyware.com/detailed-submission/failure-logs/clone-api-for-partial-success.md): Clones the STIX or Detailed Submission form. • [Get Export API](https://ctixapiv3.cyware.com/detailed-submission/failure-logs/export-api.md): Exports the API to download the failure logs with the provided token. • [Allowed Indicators](https://ctixapiv3.cyware.com/indicators-allowed.md): The allowed list consists of indicators that are considered non-malicious for the platform. This set of APIs is used to create, retrieve, update, and delete an allowed list. For more information, see Allowed Indicators . • [Third-Party Indicators](https://ctixapiv3.cyware.com/indicators-allowed/third-party-indicators.md): Intel Exchange now supports accessing third-party repositories, such as Majestic Million, which provides a list of well-known IOCs.With access to millions of IOCs, Intel Exchange can verify incoming data, enhancing the detection and segregation of well-known IOCs. These repositories also help filter commonly known allowed indicators, allowing focused research on relevant and targeted intelligence. Additionally, if an allowed indicator is reported as suspicious, Intel Exchange offers an option to add it to the third-party ignored list. • [Search Indicator in Third-Party Repository](https://ctixapiv3.cyware.com/indicators-allowed/third-party-indicators/search-indicator-in-third-party-repository.md): Search for an indicator in the third-party allowed indicator repository or the third-party ignored indicator list. • [Add Third-Party Allowed Indicator to Ignored List](https://ctixapiv3.cyware.com/indicators-allowed/third-party-indicators/add-third-party-allowed-indicator-to-ignored-list.md): Add an indicator from the third-party allowed indicator repository to the third-party ignored indicator list in Intel Exchange. • [Get Third-Party Ignored Indicators List](https://ctixapiv3.cyware.com/indicators-allowed/third-party-indicators/list-third-party-ignored-indicators.md): Returns the third-party indicators added to the ignored list in Intel Exchange. • [Remove Indicator from Third-Party Ignored List](https://ctixapiv3.cyware.com/indicators-allowed/third-party-indicators/remove-indicator-from-third-party-ignored-list.md): Removes an indicator from the third-party ignored list. • [Get Allowed Indicators List](https://ctixapiv3.cyware.com/indicators-allowed/list-allowed-indicators.md): Returns a list of allowed indicators from the Intel Exchange platform. • [Get Allowed Indicator Details](https://ctixapiv3.cyware.com/indicators-allowed/allowed-indicator-details.md): Returns the details of an allowed indicator. • [Get Supported Allowed Indicator Types List](https://ctixapiv3.cyware.com/indicators-allowed/list-supported-allowed-indicator-types.md): Returns the supported types of IOCs that can be added to the allowed indicators list. • [Add Indicators to Allowed List](https://ctixapiv3.cyware.com/indicators-allowed/add-indicators-to-allowed-list.md): Adds a list of indicators of a common IOC type to the allowed indicators list. • [Update Allowed Indicator](https://ctixapiv3.cyware.com/indicators-allowed/update-allowed-indicator.md): Updates the specified allowed indicator. • [Delete Allowed Indicator](https://ctixapiv3.cyware.com/indicators-allowed/delete-allowed-indicator.md): Deletes a particular allowed indicator entry from the dashboard. • [Get Reasons List](https://ctixapiv3.cyware.com/indicators-allowed/reasons-list.md): Returns a paginated response with all the saved reasons for an allowed indicator. • [Delete Reason](https://ctixapiv3.cyware.com/indicators-allowed/delete-reason.md): Deletes a particular reason for an allowed indicator. • [Update Reason](https://ctixapiv3.cyware.com/indicators-allowed/update-reason.md): Updates a particular reason to add an indicator to the allowed list. • [Create Reason](https://ctixapiv3.cyware.com/indicators-allowed/create-reason.md): Creates a new reason for an allowed indicator. • [Parse IOC](https://ctixapiv3.cyware.com/indicators-allowed/parse-ioc.md): Parse the IOCs provided by the user. Further, validate and categorize the IOCs as valid or invalid. • [Bulk Action](https://ctixapiv3.cyware.com/indicators-allowed/bulk-action.md): Perform bulk actions such as follow, unfollow, and delete on multiple allowed indicators in one API request. • [Verify Allowed Indicators](https://ctixapiv3.cyware.com/indicators-allowed/verify-allowed-indicators.md): Verify if an indicator is added to the allowed indicators list in the platform. • [Watchlist](https://ctixapiv3.cyware.com/watchlist.md): A Watchlist is any keyword that you can add for surveillance or to closely monitor. It can be an IP address, a hash, a domain, a URL, a technical term, a non-technical term, or any other word or number. For more information, see Watchlist . • [Get Watchlist Keywords List](https://ctixapiv3.cyware.com/watchlist/list-watchlist-keywords.md): Returns a list of keywords from the watchlist. • [Add Keyword to Watchlist](https://ctixapiv3.cyware.com/watchlist/add-keyword-to-watchlist.md): Adds a keyword to the watchlist. • [Update Watchlist](https://ctixapiv3.cyware.com/watchlist/update-watchlist.md): Updates the details of a keyword in the watchlist. • [Delete Watchlist](https://ctixapiv3.cyware.com/watchlist/delete-watchlist.md): Deletes a keyword from the watchlist. • [Get Watchlist Feeds](https://ctixapiv3.cyware.com/watchlist/watchlist-feeds.md): Returns the occurrence details of a watchlist keyword. • [Tags](https://ctixapiv3.cyware.com/tags.md): Tags are the labels attached to threat data objects to identify or group them. For more information, see Tag Management . • [Get Tags List](https://ctixapiv3.cyware.com/tags/list-tags.md): Returns a list of tags from Intel Exchange. • [Get Tag Details](https://ctixapiv3.cyware.com/tags/tag-details.md): Returns the details of a tag. • [Create Tag](https://ctixapiv3.cyware.com/tags/create-tag.md): Creates a tag in the Intel Exchange platform. • [Update Tag](https://ctixapiv3.cyware.com/tags/update-tag.md): Updates the name and color-code of a tag. • [Get Allowed Tag Categories](https://ctixapiv3.cyware.com/tags/get-allowed-tag-group-categories.md): Returns a list of tag categories that the current user has access to. • [Tag Groups](https://ctixapiv3.cyware.com/tag-groups.md): Tag Groups are collections of related tags that help organize and manage threat intelligence more efficiently. A tag group can include multiple tags of different categories, such as malware types, threat actors, or campaigns, allowing users to group and analyze related information together. For more information, see Tag Groups . • [Get Tag Groups List](https://ctixapiv3.cyware.com/tag-groups/get-list-tag-groups.md): Returns a list of tag groups from Intel Exchange. • [Create Tag Group](https://ctixapiv3.cyware.com/tag-groups/get-list-tag-groups-copy.md): Create a new Tag Group in the Intel Exchange platform. The same endpoint can be used to clone an existing tag group. The cloned group retains all properties of the original, with copy appended to its name • [List Tags in Tag Group](https://ctixapiv3.cyware.com/tag-groups/get-tag-group-details.md): Returns detailed information about a specific tag group using its unique identifier. • [Update Tag Group](https://ctixapiv3.cyware.com/tag-groups/list-tags-in-tag-group-copy.md): Update all fields of an existing tag group with new values. • [Bulk Action](https://ctixapiv3.cyware.com/tag-groups/bulk-action.md): Perform bulk operations to enable or disable multiple tag groups in a single request. • [Disable Bulk Tag Group](https://ctixapiv3.cyware.com/tag-groups/bulk-action/copy.md): Disable multiple tag groups in a single request to deactivate them from use. • [Enable Bulk Tag Group](https://ctixapiv3.cyware.com/tag-groups/bulk-action/enable-bulk-tag-group.md): Enable multiple tag groups in a single request to activate them for use. • [Status Check](https://ctixapiv3.cyware.com/status-check.md): Checks the service status of your subscribers and collections. • [Get Heartbeat](https://ctixapiv3.cyware.com/status-check/heartbeat.md): Returns the status of subscribers and collections indicating the health of the service. • [Dashboards](https://ctixapiv3.cyware.com/dashboards.md): Dashboards allow you to visualize data that impact the security efforts on the overall Threat Intelligence lifecycle. You can gain a better understanding of the threats your organization faces. Analysts from the threat intelligence teams can monitor the flow of threat intelligence data in an actionable and meaningful way. For more information, see Dashboards . • [Widgets](https://ctixapiv3.cyware.com/dashboards/widgets.md): Widgets are the building blocks of a dashboard that consolidate the related data of one type and provide valuable information. A dashboard includes multiple widgets that are related to the use case of the dashboard. There are two types of widgets: Summary Widgets : Summary widgets display information about a specific entity based on the time frame selected for the dashboard. For example, Domain Objects. Information Widgets : Information widgets display a comparison among two or more entities based on the time frame selected for the dashboard. You can view data in various layouts, such as graphs, pie charts, line charts, and more. For example, Feed Sources vs IOCs. • [Get Widgets List](https://ctixapiv3.cyware.com/dashboards/widgets/list-widgets.md): Returns the list of widgets in the widget library. • [Get Widget Configurations](https://ctixapiv3.cyware.com/dashboards/widgets/reterive-widget-configurations.md): Returns the configuration details of a widget. • [Get Widget Data](https://ctixapiv3.cyware.com/dashboards/widgets/retrieve-widget-data.md): Returns the data returned by a widget based on the widget configuration. • [Delete Widget](https://ctixapiv3.cyware.com/dashboards/widgets/delete-widget.md): Deletes a custom widget from the platform. • [Get Dashboards List](https://ctixapiv3.cyware.com/dashboards/list-dashboards.md): Returns all system dashboards as well as dashboards you created. • [Get Dashboard Details](https://ctixapiv3.cyware.com/dashboards/retrieve-dashboard-details.md): Returns data about the specific dashboard ID. • [Get Top Level Domain (TLD)](https://ctixapiv3.cyware.com/dashboards/retrieve-top-level-domain-tld.md): Returns all top-level domains in Intel Exchange. • [Export Dashboard](https://ctixapiv3.cyware.com/dashboards/export-dashboard.md): Exports a dashboard in the Intel Exchange application. On successful exporting, you will receive an email with the subject line Cyware Dashboard Report Mail . • [Delete Custom Dashboard](https://ctixapiv3.cyware.com/dashboards/delete-custom-dashboard.md): Deletes a custom dashboard for the given dashboard ID. You can retrieve the ID using the List Dashboards API . • [Reports](https://ctixapiv3.cyware.com/reports.md): Reports present complex data and insights in a more understandable and actionable format. Reports further empower analysts to share timely and relevant information with key stakeholders, such as management, security teams, and other relevant parties. Intel Exchange supports the following types of reports: Standard Reports : Leverage saved searches, CQL queries, and filters to access specific data sets and build reports based on the selected parameters. Advanced Reports : Leverage widgets, tables, queries, filters, and images to access data and present it in an understandable and visually appealing format. For more information, see Reports . • [Create Report](https://ctixapiv3.cyware.com/reports/create-report.md): Create a basic (standard) report in Intel Exchange. Do not use this endpoint to create advanced reports. • [Run Report](https://ctixapiv3.cyware.com/reports/run-report.md): Runs a report and sends the file to the recipients. • [Get Reports List](https://ctixapiv3.cyware.com/reports/list-reports.md): Returns a list of reports from the Intel Exchange application. • [Get Report Details](https://ctixapiv3.cyware.com/reports/report-details.md): Returns the details of a report. • [Update Report](https://ctixapiv3.cyware.com/reports/update-report.md): Updates specific fields of a report. Do not use this endpoint to update advanced reports. • [Get Report Run Logs List](https://ctixapiv3.cyware.com/reports/list-report-run-logs.md): Returns the run logs of a report. • [Get Token to Download File](https://ctixapiv3.cyware.com/reports/token-to-download-file.md): Generates a token to download a file. • [Get Download File](https://ctixapiv3.cyware.com/reports/download-file.md): Downloads a file. • [Delete Report](https://ctixapiv3.cyware.com/reports/delete-report.md): Delete a report from the Intel Exchange application. You can only delete reports that are created by you. Retrieve the report_id using List Reports or Report Details APIs. • [PIR](https://ctixapiv3.cyware.com/pir.md): The Central PIR API enables you to programmatically create and manage Priority Intelligence Requirements (PIRs), retrieve matched intelligence, monitor signals, and access dashboard metrics in Intel Exchange. Changelog Release v3.7.7.4 Added the Central PIR API , a new set of endpoints to programmatically create and manage Priority Intelligence Requirements (PIRs), retrieve matched intelligence, monitor signals, and access dashboard metrics in Intel Exchange. Common Error Codes All error responses share the following structure: Plain text { "code" "CPIR-003", "title": "Record not found" } { "code" "CPIR-003", "title": "Record not found" } HTTPS Status Code Description 400 CPIR-002 One or more required fields are missing, empty, or contain invalid values. 401 CPIR-004 The Authorization header is missing, or the token is invalid. 401 CPIR-005 The tenant derived from the token is not found or is inactive. 403 CPIR-011 The tenant has reached the maximum number of active PIRs. 404 CPIR-003 The requested record does not exist or belongs to a different tenant. 409 CPIR-007 The request conflicts with the current state, for example, a duplicate category name or an invalid signal status transition. 422 CPIR-008 A field contains a value that is not in the accepted enum set. 429 CPIR-006 The request rate limit has been exceeded. 500 CPIR-001 An unexpected internal server error occurred. 503 CPIR-009 The service is temporarily unavailable. 503 CPIR-012 Tenant provisioning is in progress. The response includes a Retry-After: 5 header. 504 CPIR-010 The request timed out at the gateway. Common Pagination All list endpoints return the following envelope: Field Type Description results Array Returns the current page of objects. total Integer Returns the total number of records matching the query across all pages. page Integer Returns the current page number. Pages are 1-based. page_size Integer Returns the number of records on the current page. The default is 10, and the maximum is 100. Values outside this range are silently clamped to 10. next String Returns the relative URL for the next page, with all original query parameters preserved. Returns an empty string on the last page. previous String Returns the relative URL for the previous page. Returns an empty string on the first page • [Auth](https://ctixapiv3.cyware.com/pir/auth.md): All requests except system health checks require a bearer token in the Authorization header in the format CYW <token> . Call the Login endpoint first to obtain a token, which is then automatically applied to subsequent requests via collection auth. • [Login](https://ctixapiv3.cyware.com/pir/auth/login.md): Authenticates a user against the API Gateway and returns a session token. Store the token and pass it as CYW <token> in the Authorization header for all subsequent API calls. The login endpoint is served under /cpapi , not under the /cpapi/cpir prefix used by all other PIR endpoints. • [PIR Management](https://ctixapiv3.cyware.com/pir/pir-management.md): Endpoints for the full lifecycle of Priority Intelligence Requirements, covering intent analysis, overlap checking, creation, retrieval, update, and status transitions. • [Analyse Intent](https://ctixapiv3.cyware.com/pir/pir-management/analyse-intent.md): Evaluates a proposed intent string across four quality dimensions without persisting any data. Returns a composite quality score, per-dimension scores, suggested improvements, and a suggested title and category. Use this before creating or updating a PIR to surface gaps in the intent before committing. Requires LiteLLM. When the LLM is unavailable, all dimension scores and the quality score return as zero and a default set of suggestion chips is returned. • [Enhance Intent](https://ctixapiv3.cyware.com/pir/pir-management/enhance-intent.md): Rewrites a vague or incomplete intent into a precise, well-structured monitoring requirement using an LLM. Returns the enhanced text for analyst review before it is committed. Only intent is required. Passing quality context from a prior Analyze Intent call focuses the rewrite on the weakest dimensions. Returns 500 when LiteLLM is unavailable. • [Check Overlap](https://ctixapiv3.cyware.com/pir/pir-management/check-overlap.md): Checks whether a proposed intent semantically duplicates one or more existing PIRs in the tenant. Returns overlapping PIRs ranked by similarity score. Use this during PIR creation to identify consolidation opportunities before committing to a new requirement. When checking overlap for an existing PIR during an update, pass exclude_pir_id to exclude it from the results. • [Create PIR](https://ctixapiv3.cyware.com/pir/pir-management/create-pir.md): Creates a new Priority Intelligence Requirement for the authenticated tenant. On creation, an embedding job is queued in the Central Embedding Service (CES), and a match sweep runs automatically once the embedding completes. category_ids is required when status is active . A PIR activated without categories returns 400 CPIR-002 . • [List PIRs](https://ctixapiv3.cyware.com/pir/pir-management/list-pirs.md): Returns a paginated list of PIRs visible to the authenticated user within their tenant. Supports filtering by status, priority, health band, and keyword search. • [Get PIR by ID](https://ctixapiv3.cyware.com/pir/pir-management/get-pir-by-id.md): Returns the full details of a single PIR. Accepts either a KSUID or a human-readable ID such as PIR001 . Returns 404 CPIR-003 , if the PIR does not exist or belongs to a different tenant. • [Update PIR](https://ctixapiv3.cyware.com/pir/pir-management/update-pir.md): Updates the mutable fields of an existing PIR. This is a partial update; only fields present in the request body are applied. Omitted fields retain their current values. intent is the only required field. Changing it re-queues the CES embedding job and triggers a new match sweep cycle. • [Update PIR Status](https://ctixapiv3.cyware.com/pir/pir-management/update-pir-status.md): Transitions a PIR to a new lifecycle status. Status changes affect whether the PIR participates in match sweeps and signal evaluation and may trigger side effects such as auto-resolving open signals. Lifecycle States State Behaviour Match Sweeps draft Saved but not yet submitted for monitoring. Excluded active Fully operational. Requires at least one category; returns 400 CPIR-002 otherwise. Included inactive Temporarily suspended. Open signals are auto-resolved on transition. Excluded expired End-of-life. Open signals are auto-resolved and the CES record is deprecated. Excluded deleted Soft-deleted. Excluded from list results. Open signals are auto-resolved and matches are marked removed. Excluded • [Matches](https://ctixapiv3.cyware.com/pir/matches.md): Endpoints for retrieving and managing intelligence objects matched to PIRs. Supports ranked cross-PIR views, per-PIR match listings with flexible filtering, and manual link and delink operations to override automatic sweep behaviour. • [Top Objects by Type (Cross-PIR)](https://ctixapiv3.cyware.com/pir/matches/top-objects-by-type-cross-pir.md): Returns intelligence objects of a given type ranked by the number of active PIRs they are linked to. Use this for a tenant-wide view of which objects are most broadly relevant across all requirements. Pass overview=true to retrieve the top 7 objects for use in dashboard widgets, bypassing standard pagination. • [List Entity Matches for PIR](https://ctixapiv3.cyware.com/pir/matches/list-entity-matches-for-pir.md): Returns the intelligence objects currently matched to a specific PIR, ordered by relevance score in descending by default. At least one of include__object_type , object_type , or entity_kind is required; omitting all three returns 400 CPIR-002 . object_type now applies AND semantics across multiple values. Because each matched row holds a single object type, a multi-value AND is structurally unsatisfiable and always returns an empty result. Use include__object_type for OR filtering across multiple types. Single-value object_type is unaffected. • [Bulk Link Entities](https://ctixapiv3.cyware.com/pir/matches/bulk-link-entities-1.md): Manually links one or more intelligence objects to a PIR by setting their link status to manual_link . The entities must already exist as match records for the PIR. If an entity is not a match record for this PIR, it is silently skipped, and the updated count reflects only the entities that were actually changed. Triggers a match snapshot write on success. • [Bulk Delink Entities](https://ctixapiv3.cyware.com/pir/matches/bulk-delink-entities.md): Manually remove one or more intelligence objects from a PIR by setting their link status to manual_delink . Delinked entities are permanently suppressed from auto-relinking on future sweep cycles unless manually linked again. Triggers a match snapshot write on success. • [Signals](https://ctixapiv3.cyware.com/pir/signals.md): Endpoints for listing signals, transitioning signal statuses, and retrieving signal metrics. Signals are available at the tenant level across all PIRs and scoped to individual PIRs. • [List Signals (Tenant-wide)](https://ctixapiv3.cyware.com/pir/signals/list-signals-tenant-wide.md): Returns a paginated list of all signals across the tenant. Filter parameters that accept multiple values use OR semantics; repeat the parameter to filter by more than one value. • [Update Signal Status](https://ctixapiv3.cyware.com/pir/signals/update-signal-status.md): Transitions a signal to a new status. Not all transitions are permitted; see the transition rules below. Returns 409 CPIR-007 when the transition is not allowed from the signal's current state. Transition Rules Target status Allowed from Failure acknowledged triggered only 409 CPIR-007 with "signal is not in triggered state" resolved triggered or acknowledged 409 CPIR-007 with "signal cannot be resolved from its current state" dismissed Any status N/A • [Active Signal Count](https://ctixapiv3.cyware.com/pir/signals/active-signal-count.md): Returns the count of signals in triggered or acknowledged status across the tenant. This is the same value surfaced as the open signals count in the dashboard. • [Top Prioritized Signals (Tenant-wide)](https://ctixapiv3.cyware.com/pir/signals/top-prioritized-signals-tenant-wide.md): Returns the top 3 signals across the tenant ranked by a composite of severity and confidence. Only signals in triggered or acknowledged status are eligible. Use this to power the prioritised signals widget on the dashboard. • [PIR Metrics](https://ctixapiv3.cyware.com/pir/pir-metrics.md): Endpoints powering the dashboard and PIR detail view. Covers ranked PIR lists, health aggregates and scores, signal counts, and 7-day match trend data. • [Most-Active PIRs](https://ctixapiv3.cyware.com/pir/pir-metrics/most-active-pirs.md): Returns up to 5 PIRs ranked by the most recent signal emission time. Use this to populate the Most Active PIRs widget on the dashboard. • [PIR Health Aggregate](https://ctixapiv3.cyware.com/pir/pir-metrics/pir-health-aggregate.md): Returns the count of active PIRs in each health band plus the 7-day change in unhealthy PIRs. Use this to populate the Health Status widget on the dashboard. • [Per-PIR Signal Count](https://ctixapiv3.cyware.com/pir/pir-metrics/per-pir-signal-count.md): Returns the count of signals in triggered or acknowledged status for a specific PIR. • [Per-PIR Top Prioritized Signals](https://ctixapiv3.cyware.com/pir/pir-metrics/per-pir-top-prioritized-signals.md): Returns the top-prioritized signals for a specific PIR using the same ranking logic as the tenant-wide endpoint. • [PIR Trends (7-day)](https://ctixapiv3.cyware.com/pir/pir-metrics/pir-trends-7-day.md): Returns the 7-day link and delink deltas for matched intelligence objects of a specific PIR. The response is a flat object: top-level keys carry the overall totals, and one additional key per active object type carries a per-type breakdown. Object types with no activity in the window are omitted. • [Get PIR Health Score](https://ctixapiv3.cyware.com/pir/pir-metrics/get-pir-health-score.md): Returns the most recent health snapshot for a specific PIR. The health score is computed by the Health Worker on a schedule and after each match sweep. Returns 404 CPIR-003 until the Health Worker has run at least once for the PIR. • [Tenant Configuration](https://ctixapiv3.cyware.com/pir/tenant-configuration.md): Read-only endpoint returning the calling tenant's operational tuning parameters and telemetry configuration. Values are set at the deployment level and are identical across all tenants in a given deployment. • [Get Tenant Configuration](https://ctixapiv3.cyware.com/pir/tenant-configuration/get-tenant-configuration.md): Returns the tenant's CES tuning parameters, escalation thresholds, and telemetry configuration. The telemetry fields are passed through to the frontend to enable click-event capture and are not stored per tenant. • [System](https://ctixapiv3.cyware.com/pir/system.md): Unauthenticated health check endpoints served directly on the internal server port, bypassing the API gateway. • [Liveness Check](https://ctixapiv3.cyware.com/pir/system/liveness-check.md): Confirms the service process is running. Does not probe downstream dependencies. Used by the container orchestrator as a process-level health check. • [Readiness Check](https://ctixapiv3.cyware.com/pir/system/readiness-check.md): Confirms that the service and its dependencies, the database (via PgBouncer) and the Central Embedding Service (CES), are reachable. Returns 200 only when all dependencies are healthy; returns 503 when any dependency is down. Used by the orchestrator to gate traffic routing. • [Prometheus Metrics](https://ctixapiv3.cyware.com/pir/system/prometheus-metrics.md): Exposes operational metrics in Prometheus text exposition format. Served on a dedicated port (`:2424`) separate from the API port. Both the API server and the worker binary expose this endpoint independently on their own :2424 ports.