generated: '2026-07-18'
method: derived
source: openapi/demisto-openapi-original.json
note: Entity-relationship graph derived from Swagger 2.0 $ref links. The Demisto model centers on Incidents,
  Entries (war-room), Evidence, Indicators (threat intel), and Automation Scripts.
entities:
- name: CreateIncidentRequest
  definition: openapi/demisto-openapi-original.json#/definitions/CreateIncidentRequest
- name: Incident
  definition: openapi/demisto-openapi-original.json#/definitions/Incident
- name: Entry
  definition: openapi/demisto-openapi-original.json#/definitions/Entry
- name: Evidence
  definition: openapi/demisto-openapi-original.json#/definitions/Evidence
- name: AutomationScript
  definition: openapi/demisto-openapi-original.json#/definitions/AutomationScript
- name: FeedIndicator
  definition: openapi/demisto-openapi-original.json#/definitions/FeedIndicator
- name: IndicatorResult
  definition: openapi/demisto-openapi-original.json#/definitions/IndicatorResult
- name: Investigation
  definition: openapi/demisto-openapi-original.json#/definitions/Investigation
relationships:
- from: CreateIncidentRequest
  to: Label
  kind: has_many
  via: labels
- from: CreateIncidentRequest
  to: RunStatus
  kind: has_one
  via: runStatus
- from: CreateIncidentRequest
  to: Severity
  kind: has_one
  via: severity
- from: CreateIncidentRequest
  to: SLAState
  kind: has_one
  via: sla
- from: CreateIncidentRequest
  to: IncidentStatus
  kind: has_one
  via: status
- from: CreateIncidentRequest
  to: CustomFields
  kind: has_one
  via: CustomFields
- from: Incident
  to: Attachment
  kind: has_many
  via: attachment
- from: Incident
  to: Label
  kind: has_many
  via: labels
- from: Incident
  to: RunStatus
  kind: has_one
  via: runStatus
- from: Incident
  to: Severity
  kind: has_one
  via: severity
- from: Incident
  to: SLAState
  kind: has_one
  via: sla
- from: Incident
  to: IncidentStatus
  kind: has_one
  via: status
- from: Incident
  to: CustomFields
  kind: has_one
  via: CustomFields
- from: Entry
  to: EntryCategory
  kind: has_one
  via: category
- from: Entry
  to: EndingType
  kind: has_one
  via: endingType
- from: Entry
  to: EntryTask
  kind: has_one
  via: entryTask
- from: Entry
  to: FileMetadata
  kind: has_one
  via: fileMetadata
- from: Entry
  to: EntryHistory
  kind: has_many
  via: history
- from: Entry
  to: HumanCron
  kind: has_one
  via: humanCron
- from: Entry
  to: EntryReputation
  kind: has_many
  via: reputations
- from: Entry
  to: EntryType
  kind: has_one
  via: type
- from: AutomationScript
  to: Argument
  kind: has_many
  via: arguments
- from: AutomationScript
  to: Important
  kind: has_many
  via: important
- from: AutomationScript
  to: Output
  kind: has_many
  via: outputs
- from: AutomationScript
  to: ScriptTarget
  kind: has_one
  via: scriptTarget
- from: AutomationScript
  to: ScriptSubType
  kind: has_one
  via: subtype
- from: AutomationScript
  to: Duration
  kind: has_one
  via: timeout
- from: AutomationScript
  to: ScriptType
  kind: has_one
  via: type
- from: FeedIndicator
  to: ExpirationSource
  kind: has_one
  via: ExpirationSource
- from: FeedIndicator
  to: ExpirationPolicy
  kind: has_one
  via: expirationPolicy
- from: FeedIndicator
  to: CustomFields
  kind: has_one
  via: fields
- from: FeedIndicator
  to: Reliability
  kind: has_one
  via: reliability
- from: IndicatorResult
  to: IocObjects
  kind: has_one
  via: iocObjects
- from: Investigation
  to: RunStatus
  kind: has_one
  via: runStatus
- from: Investigation
  to: InvestigationStatus
  kind: has_one
  via: status
- from: Investigation
  to: System
  kind: has_many
  via: systems
- from: Investigation
  to: InvestigationType
  kind: has_one
  via: type