{ "swagger": "2.0", "x-id": [ "reitit.swagger/default" ], "info": { "title": "Conure", "version": "conure-218-1-ee422dee", "license": { "name": "All Rights Reserved", "url": "https://www.cisco.com" }, "contact": { "name": "Cisco Security Business Group -- Advanced Threat", "email": "cisco-intel-api-support@cisco.com" }, "description": "XDR High Priority Incident and Investigation API", "x-provenance": { "method": "harvested", "authored_by": "Cisco XDR", "harvested_by": "API Evangelist", "harvested_on": "2026-08-19", "first_party": true, "provider_published": true, "source_host": "visibility.amp.cisco.com", "note": "Anonymously fetchable Swagger 2.0 for nine IROH services plus the CTIA threat-intelligence API. The host returns real 404s on invented paths, so the 200s are genuine." }, "x-evidence": [ { "type": "source", "url": "https://visibility.amp.cisco.com/iroh/iroh-int/swagger.json" }, { "type": "source", "url": "https://private.intel.amp.cisco.com/swagger.json" } ] }, "securityDefinitions": { "JWT-Bearer": { "type": "apiKey", "name": "Authorization", "in": "header" }, "oauth2": { "type": "oauth2", "tokenUrl": "https://visibility.amp.cisco.com/iroh/oauth2/token", "refreshUrl": "https://visibility.amp.cisco.com/iroh/oauth2/refresh", "authorizationUrl": "https://visibility.amp.cisco.com/iroh/oauth2/authorize", "scopes": { "event:read": "Get event information for an org. Needed to get full report information.", "private-intel:read": "Read data from private intel. Needed to get investigation data.", "private-intel": "Full private intel integration scope.", "asset": "Get Data from Device Insights. Needed during running investigations.", "enrich:read": "Fetch Data about observables. Needed for investigations.", "integration:read": "Get module information. Needed to create a new investigation.", "investigation": "Run investigations. Needed for investigations.", "casebook": "Full casebook management access. Allows read, write to casebooks.", "casebook:read": "Read Casebook access", "global-intel:read": "Read data from public intel. Needed to fetch global incident data and investigations.", "private-intel:write": "Private intel write scope.", "ao": "Execute and read workflows", "playbook:read": "Get playbook state. Needed to get full report information." }, "flow": "accessCode" } }, "paths": { "/v1/incident-summary/search": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": { "assignees": { "type": "array", "items": { "type": "string" } }, "categories": { "type": "array", "items": { "type": "string", "enum": [ "Attrition", "Denial of Service", "Exercise", "Exercise/Network Defense Testing", "Explained Anomaly", "Forensics", "Improper Usage", "Intelligence", "Investigating", "Investigation", "Malicious Code", "Malicious Logic", "Non-Compliant", "Reconnaissance", "Root Level", "Scans/Probes/Attempted Access", "Unauthorized Access", "Unsuccessful", "User Level", "eDiscovery" ] } }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "detection_sources": { "type": "array", "items": { "type": "string" } }, "detection_status": { "title": "DetectionStatusType", "type": "string", "enum": [ "active", "inactive_merged", "inactive_expired", "inactive_oversized", "inactive_user_closed" ], "description": "Whether the incident is actively receiving detection data updates" }, "discovery_method": { "type": "string", "enum": [ "SecureX Threat Hunting", "Agent Disclosure", "Antivirus", "Audit", "Customer", "External - Fraud Detection", "Financial Audit", "HIPS", "IT Audit", "Incident Response", "Internal - Fraud Detection", "Law Enforcement", "Log Review", "Monitoring Service", "NIDS", "Security Alarm", "Unknown", "Unrelated Party", "User" ] }, "incident_time": { "type": "object", "properties": { "opened": { "type": "string" }, "closed": { "type": "string" }, "discovered": { "type": "string" }, "rejected": { "type": "string" }, "remediated": { "type": "string" }, "reported": { "type": "string" } }, "required": [ "opened" ] }, "intended_effect": { "type": "string", "enum": [ "Account Takeover", "Advantage", "Advantage - Economic", "Advantage - Military", "Advantage - Political", "Brand Damage", "Competitive Advantage", "Degradation of Service", "Denial and Deception", "Destruction", "Disruption", "Embarrassment", "Exposure", "Extortion", "Fraud", "Harassment", "ICS Control", "Theft", "Theft - Credential Theft", "Theft - Identity Theft", "Theft - Intellectual Property", "Theft - Theft of Proprietary Information", "Traffic Diversion", "Unauthorized Access" ] }, "meta": { "type": "object", "properties": { "ai_description": { "type": "boolean" }, "helios_report_generated": { "type": "boolean" } } }, "promotion_method": { "type": "string", "enum": [ "Automated", "Manual" ] }, "scores": { "type": "object", "properties": { "asset": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 10 }, "global": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 1000 }, "ml_score": { "type": "number", "format": "double" }, "ttp": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 100 } } }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_id": { "type": "string" }, "status": { "title": "IncidentStatusType", "type": "string", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ], "description": "The status of the incident" }, "tactics": { "type": "array", "items": { "type": "string" } }, "techniques": { "type": "array", "items": { "type": "string" } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "incident" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "summary": { "type": "object", "properties": { "eventsCount": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "firstEventDate": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "date-time" } ], "x-nullable": true }, "lastEventDate": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "date-time" } ], "x-nullable": true }, "indicators": { "type": "object", "properties": { "totalCount": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "producer": { "type": "string" }, "source": { "type": "string", "x-nullable": true }, "internal": { "type": "boolean" }, "id": { "type": "string" }, "value": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" }, "x-nullable": true } }, "required": [ "count", "producer", "source", "internal", "id", "value", "tags" ] } } }, "required": [ "totalCount", "data" ] }, "mitreData": { "type": "object", "properties": { "totalCount": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string", "enum": [ "TA0004", "TA0010", "TA0005", "TA0001", "TA0009", "TA0002", "TA0040", "TA0043", "TA0011", "TA0008", "TA0042", "TA0006", "TA0007", "TA0003" ] }, "title": { "type": "string", "enum": [ "Privilege Escalation", "Exfiltration", "Defense Evasion", "Initial Access", "Collection", "Execution", "Impact", "Reconnaissance", "Command and Control", "Lateral Movement", "Resource Development", "Credential Access", "Discovery", "Persistence" ] }, "phase_name": { "type": "string", "enum": [ "privilege-escalation", "exfiltration", "defense-evasion", "initial-access", "collection", "execution", "impact", "reconnaissance", "command-and-control", "lateral-movement", "resource-development", "credential-access", "discovery", "persistence" ] }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "value", "title", "phase_name", "count" ] } } }, "required": [ "totalCount", "data" ] }, "observables": { "type": "object", "properties": { "totalCount": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string" }, "value": { "type": "string" } }, "required": [ "count", "type", "value" ] } } }, "required": [ "totalCount", "data" ] }, "severity": { "type": "object", "properties": { "totalCount": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "value": { "type": "string" } }, "required": [ "count", "value" ] } } }, "required": [ "totalCount", "data" ] }, "source": { "type": "object", "properties": { "totalCount": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "value": { "type": "string" } }, "required": [ "count", "value" ] } } }, "required": [ "totalCount", "data" ] }, "targets": { "type": "object", "properties": { "totalCount": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "value": { "type": "string" }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2, "x-nullable": true }, "observableType": { "type": "string" }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true }, "asset_id": { "type": "string", "x-nullable": true }, "properties": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": { "type": "string" } } ] } }, "required": [ "name", "value" ] }, "uniqueItems": true } }, "required": [ "type", "count", "value", "observableType", "observables", "asset_id", "properties" ] } } }, "required": [ "totalCount", "data" ] }, "top_assets": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "value": { "type": "string" }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2, "x-nullable": true }, "observableType": { "type": "string" }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true }, "asset_id": { "type": "string", "x-nullable": true }, "properties": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": { "type": "string" } } ] } }, "required": [ "name", "value" ] }, "uniqueItems": true } }, "required": [ "type", "count", "value", "observableType", "observables", "asset_id", "properties" ] }, "maxItems": 5 } }, "required": [ "eventsCount", "firstEventDate", "lastEventDate", "indicators", "mitreData", "observables", "severity", "source", "targets", "top_assets" ] } }, "required": [ "confidence", "incident_time", "status", "id", "groups", "schema_version", "type", "summary" ] } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "query", "name": "sort_by", "description": "Sort result on fields.\n\nThe following fields are supported:\nid, language, revision, schema_version, source, source_uri, timestamp, title, tlp\n\nFields can be combined with ',' and sort order can be\nspecified by ':asc' and ':desc'. For example:\n- id # sort by id ascending\n- id:desc # sort by id descending\n- id,language:desc # sort by id ascending, then language descending", "type": "string", "required": false }, { "in": "query", "name": "sort_order", "description": "", "type": "string", "required": false, "enum": [ "asc", "desc" ] }, { "description": "A integer greater than 0.", "format": "int64", "name": "offset", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "description": "A integer greater than 0.", "format": "int64", "name": "limit", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "in": "query", "name": "search_after", "description": "", "type": "array", "required": false, "items": { "type": "string" }, "x-anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "string" } ], "allowEmptyValue": true }, { "in": "query", "name": "fields", "description": "", "type": "array", "required": false, "items": { "type": "array", "items": { "type": "string", "enum": [ "assignees", "confidence", "detection_sources", "discovery_method", "id", "incident_time.opened", "incident_time.discovered", "incident_time.reported", "incident_time.remediated", "incident_time.closed", "incident_time.rejected", "intended_effect", "language", "meta", "promotion_method", "revision", "schema_version", "source", "source_uri", "status", "timestamp", "title", "tlp" ] } }, "x-anyOf": [ { "type": "array", "items": { "type": "array", "items": { "type": "string", "enum": [ "assignees", "confidence", "detection_sources", "discovery_method", "id", "incident_time.opened", "incident_time.discovered", "incident_time.reported", "incident_time.remediated", "incident_time.closed", "incident_time.rejected", "intended_effect", "language", "meta", "promotion_method", "revision", "schema_version", "source", "source_uri", "status", "timestamp", "title", "tlp" ] } } }, { "type": "string" } ], "allowEmptyValue": true }, { "in": "query", "name": "tlp", "description": "", "type": "string", "required": false, "enum": [ "amber", "green", "red", "white" ] }, { "in": "query", "name": "from", "description": "", "type": "string", "required": false, "format": "date-time" }, { "in": "query", "name": "to", "description": "", "type": "string", "required": false, "format": "date-time" }, { "in": "query", "name": "language", "description": "", "type": "string", "required": false }, { "in": "query", "name": "id", "description": "", "type": "string", "required": false }, { "in": "query", "name": "search_fields", "description": "", "type": "array", "required": false, "items": { "type": "string", "enum": [ "id", "short_description", "title", "source", "description" ] }, "x-anyOf": [ { "type": "array", "items": { "type": "string", "enum": [ "id", "short_description", "title", "source", "description" ] } }, { "type": "string" } ], "allowEmptyValue": true }, { "in": "query", "name": "source", "description": "", "type": "string", "required": false }, { "in": "query", "name": "query", "description": "", "type": "string", "required": false }, { "in": "query", "name": "simple_query", "description": "Query String with simple query format", "type": "string", "required": false }, { "description": "A integer greater than 0.", "format": "int64", "name": "revision", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "in": "query", "name": "assignees", "description": "", "type": "string", "required": false }, { "in": "query", "name": "categories", "description": "", "type": "string", "required": false }, { "in": "query", "name": "confidence", "description": "", "type": "string", "required": false }, { "in": "query", "name": "detection_sources", "description": "", "type": "string", "required": false }, { "in": "query", "name": "discovery_method", "description": "", "type": "string", "required": false }, { "in": "query", "name": "high_impact", "description": "", "type": "boolean", "required": false }, { "in": "query", "name": "intended_effect", "description": "", "type": "string", "required": false }, { "in": "query", "name": "promotion_method", "description": "", "type": "string", "required": false }, { "in": "query", "name": "status", "description": "The status of the incident", "type": "string", "required": false, "title": "IncidentStatusType", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ] } ], "tags": [ "v1" ], "summary": "Incident Summary Search", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v1/incident/{incident-id}/assets": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "value": { "type": "string" }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2, "x-nullable": true }, "observableType": { "type": "string" }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true }, "asset_id": { "type": "string", "x-nullable": true }, "properties": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": { "type": "string" } } ] } }, "required": [ "name", "value" ] }, "uniqueItems": true } }, "required": [ "type", "count", "value", "observableType", "observables", "asset_id", "properties" ] } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v1" ], "summary": "Incident Assets", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v1/incident/{incident-id}/summary": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "eventsCount": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "primaryInvestigation": { "type": "object", "properties": { "id": { "type": "string", "x-nullable": true }, "description": { "type": "string", "x-nullable": true }, "short_description": { "type": "string", "x-nullable": true }, "source": { "type": "string", "x-nullable": true } }, "required": [ "id", "description", "short_description", "source" ] }, "firstEventDate": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "date-time" } ], "x-nullable": true }, "lastEventDate": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "date-time" } ], "x-nullable": true }, "indicators": { "type": "object", "properties": { "totalCount": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "producer": { "type": "string" }, "source": { "type": "string", "x-nullable": true }, "internal": { "type": "boolean" }, "id": { "type": "string" }, "value": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" }, "x-nullable": true } }, "required": [ "count", "producer", "source", "internal", "id", "value", "tags" ] } } }, "required": [ "totalCount", "data" ] }, "mitreData": { "type": "object", "properties": { "totalCount": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string", "enum": [ "TA0004", "TA0010", "TA0005", "TA0001", "TA0009", "TA0002", "TA0040", "TA0043", "TA0011", "TA0008", "TA0042", "TA0006", "TA0007", "TA0003" ] }, "title": { "type": "string", "enum": [ "Privilege Escalation", "Exfiltration", "Defense Evasion", "Initial Access", "Collection", "Execution", "Impact", "Reconnaissance", "Command and Control", "Lateral Movement", "Resource Development", "Credential Access", "Discovery", "Persistence" ] }, "phase_name": { "type": "string", "enum": [ "privilege-escalation", "exfiltration", "defense-evasion", "initial-access", "collection", "execution", "impact", "reconnaissance", "command-and-control", "lateral-movement", "resource-development", "credential-access", "discovery", "persistence" ] }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "value", "title", "phase_name", "count" ] } } }, "required": [ "totalCount", "data" ] }, "observables": { "type": "object", "properties": { "totalCount": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string" }, "value": { "type": "string" } }, "required": [ "count", "type", "value" ] } } }, "required": [ "totalCount", "data" ] }, "severity": { "type": "object", "properties": { "totalCount": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "value": { "type": "string" } }, "required": [ "count", "value" ] } } }, "required": [ "totalCount", "data" ] }, "incident": { "type": "object", "properties": { "assignees": { "type": "array", "items": { "type": "string" } }, "categories": { "type": "array", "items": { "type": "string", "enum": [ "Attrition", "Denial of Service", "Exercise", "Exercise/Network Defense Testing", "Explained Anomaly", "Forensics", "Improper Usage", "Intelligence", "Investigating", "Investigation", "Malicious Code", "Malicious Logic", "Non-Compliant", "Reconnaissance", "Root Level", "Scans/Probes/Attempted Access", "Unauthorized Access", "Unsuccessful", "User Level", "eDiscovery" ] } }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "detection_sources": { "type": "array", "items": { "type": "string" } }, "detection_status": { "title": "DetectionStatusType", "type": "string", "enum": [ "active", "inactive_merged", "inactive_expired", "inactive_oversized", "inactive_user_closed" ], "description": "Whether the incident is actively receiving detection data updates" }, "discovery_method": { "type": "string", "enum": [ "SecureX Threat Hunting", "Agent Disclosure", "Antivirus", "Audit", "Customer", "External - Fraud Detection", "Financial Audit", "HIPS", "IT Audit", "Incident Response", "Internal - Fraud Detection", "Law Enforcement", "Log Review", "Monitoring Service", "NIDS", "Security Alarm", "Unknown", "Unrelated Party", "User" ] }, "incident_time": { "type": "object", "properties": { "opened": { "type": "string" }, "closed": { "type": "string" }, "discovered": { "type": "string" }, "rejected": { "type": "string" }, "remediated": { "type": "string" }, "reported": { "type": "string" } }, "required": [ "opened" ] }, "intended_effect": { "type": "string", "enum": [ "Account Takeover", "Advantage", "Advantage - Economic", "Advantage - Military", "Advantage - Political", "Brand Damage", "Competitive Advantage", "Degradation of Service", "Denial and Deception", "Destruction", "Disruption", "Embarrassment", "Exposure", "Extortion", "Fraud", "Harassment", "ICS Control", "Theft", "Theft - Credential Theft", "Theft - Identity Theft", "Theft - Intellectual Property", "Theft - Theft of Proprietary Information", "Traffic Diversion", "Unauthorized Access" ] }, "meta": { "type": "object", "properties": { "ai_description": { "type": "boolean" }, "helios_report_generated": { "type": "boolean" } } }, "promotion_method": { "type": "string", "enum": [ "Automated", "Manual" ] }, "scores": { "type": "object", "properties": { "asset": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 10 }, "global": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 1000 }, "ml_score": { "type": "number", "format": "double" }, "ttp": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 100 } } }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_id": { "type": "string" }, "status": { "title": "IncidentStatusType", "type": "string", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ], "description": "The status of the incident" }, "tactics": { "type": "array", "items": { "type": "string" } }, "techniques": { "type": "array", "items": { "type": "string" } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "incident" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "confidence", "incident_time", "status", "id", "groups", "schema_version", "type" ] }, "linkedIncidents": { "type": "array", "items": { "type": "object", "properties": { "assignees": { "type": "array", "items": { "type": "string" } }, "categories": { "type": "array", "items": { "type": "string", "enum": [ "Attrition", "Denial of Service", "Exercise", "Exercise/Network Defense Testing", "Explained Anomaly", "Forensics", "Improper Usage", "Intelligence", "Investigating", "Investigation", "Malicious Code", "Malicious Logic", "Non-Compliant", "Reconnaissance", "Root Level", "Scans/Probes/Attempted Access", "Unauthorized Access", "Unsuccessful", "User Level", "eDiscovery" ] } }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "detection_sources": { "type": "array", "items": { "type": "string" } }, "detection_status": { "title": "DetectionStatusType", "type": "string", "enum": [ "active", "inactive_merged", "inactive_expired", "inactive_oversized", "inactive_user_closed" ], "description": "Whether the incident is actively receiving detection data updates" }, "discovery_method": { "type": "string", "enum": [ "SecureX Threat Hunting", "Agent Disclosure", "Antivirus", "Audit", "Customer", "External - Fraud Detection", "Financial Audit", "HIPS", "IT Audit", "Incident Response", "Internal - Fraud Detection", "Law Enforcement", "Log Review", "Monitoring Service", "NIDS", "Security Alarm", "Unknown", "Unrelated Party", "User" ] }, "incident_time": { "type": "object", "properties": { "opened": { "type": "string" }, "closed": { "type": "string" }, "discovered": { "type": "string" }, "rejected": { "type": "string" }, "remediated": { "type": "string" }, "reported": { "type": "string" } }, "required": [ "opened" ] }, "intended_effect": { "type": "string", "enum": [ "Account Takeover", "Advantage", "Advantage - Economic", "Advantage - Military", "Advantage - Political", "Brand Damage", "Competitive Advantage", "Degradation of Service", "Denial and Deception", "Destruction", "Disruption", "Embarrassment", "Exposure", "Extortion", "Fraud", "Harassment", "ICS Control", "Theft", "Theft - Credential Theft", "Theft - Identity Theft", "Theft - Intellectual Property", "Theft - Theft of Proprietary Information", "Traffic Diversion", "Unauthorized Access" ] }, "meta": { "type": "object", "properties": { "ai_description": { "type": "boolean" }, "helios_report_generated": { "type": "boolean" } } }, "promotion_method": { "type": "string", "enum": [ "Automated", "Manual" ] }, "scores": { "type": "object", "properties": { "asset": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 10 }, "global": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 1000 }, "ml_score": { "type": "number", "format": "double" }, "ttp": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 100 } } }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_id": { "type": "string" }, "status": { "title": "IncidentStatusType", "type": "string", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ], "description": "The status of the incident" }, "tactics": { "type": "array", "items": { "type": "string" } }, "techniques": { "type": "array", "items": { "type": "string" } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "incident" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "confidence", "incident_time", "status", "id", "groups", "schema_version", "type" ] } }, "linkedReferences": { "type": "object", "properties": { "snapshotsCount": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "incidentsCount": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "indicatorsCount": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "casebooksCount": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "totalCount": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "snapshotsCount", "incidentsCount", "indicatorsCount", "casebooksCount", "totalCount" ] }, "linkedCasebooks": { "type": "array", "items": { "type": "object", "properties": { "bundle": { "type": "object", "properties": { "id": { "type": "string" }, "description": { "type": "string" }, "attack_patterns": { "type": "array", "items": { "type": "object", "properties": {} } }, "assets": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_properties": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_mappings": { "type": "array", "items": { "type": "object", "properties": {} } }, "casebooks": { "type": "array", "items": { "type": "object", "properties": {} } }, "indicators": { "type": "array", "items": { "type": "object", "properties": {} } }, "judgements": { "type": "array", "items": { "type": "object", "properties": {} } }, "malwares": { "type": "array", "items": { "type": "object", "properties": {} } }, "modules": { "type": "array", "items": { "type": "object", "properties": {} } }, "relationships": { "type": "array", "items": { "type": "object", "properties": {} } }, "sightings": { "type": "array", "items": { "type": "object", "properties": {} } }, "verdicts": { "type": "array", "items": { "type": "object", "properties": {} } }, "tools": { "type": "array", "items": { "type": "object", "properties": {} } } } }, "texts": { "type": "array", "items": { "type": "object", "properties": { "text": { "type": "string" }, "type": { "type": "string" } }, "required": [ "text", "type" ] } }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "casebook" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "id", "groups", "schema_version", "type" ] } }, "source": { "type": "object", "properties": { "totalCount": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "value": { "type": "string" } }, "required": [ "count", "value" ] } } }, "required": [ "totalCount", "data" ] }, "targets": { "type": "object", "properties": { "totalCount": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "value": { "type": "string" }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2, "x-nullable": true }, "observableType": { "type": "string" }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true }, "asset_id": { "type": "string", "x-nullable": true }, "properties": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": { "type": "string" } } ] } }, "required": [ "name", "value" ] }, "uniqueItems": true } }, "required": [ "type", "count", "value", "observableType", "observables", "asset_id", "properties" ] } } }, "required": [ "totalCount", "data" ] }, "graph": {} }, "required": [ "eventsCount", "primaryInvestigation", "firstEventDate", "lastEventDate", "indicators", "mitreData", "observables", "severity", "incident", "linkedIncidents", "linkedReferences", "linkedCasebooks", "source", "targets", "graph" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v1" ], "summary": "Incident Summary", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v1/incident/{incident-id}/events": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "events": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "id": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "observed_time": { "type": "object", "properties": { "start_time": { "type": "string" }, "end_time": { "type": "string", "x-nullable": true } }, "required": [ "start_time" ] }, "type": { "type": "string", "enum": [ "sighting" ] }, "context": { "x-nullable": true }, "data": { "type": "object", "properties": { "columns": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "type": { "type": "string", "enum": [ "integer", "markdown", "number", "observable", "string", "url" ] }, "description": { "type": "string", "x-nullable": true }, "required": { "type": "boolean" }, "short_description": { "type": "string", "x-nullable": true } }, "required": [ "name", "type" ] } }, "rows": { "type": "array", "items": {} }, "row_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "columns", "rows" ] }, "external_ids": { "type": "array", "items": { "type": "string" } }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "internal": { "type": "boolean" }, "language": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "resolution": { "type": "string", "enum": [ "allowed", "blocked", "contained", "detected" ] }, "sensor": { "type": "string" }, "sensor_coordinates": { "type": "object", "properties": { "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "os": { "type": "string" }, "type": { "type": "string" } }, "required": [ "observables", "type" ] }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "timestamp": { "type": "string" }, "compacted_entities": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, "compacted_relations": { "type": "array", "items": { "type": "object", "properties": { "source": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "related": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "relation": { "type": "string" }, "origin": { "type": "string" } }, "required": [ "source", "related", "relation" ] }, "uniqueItems": true }, "title": { "type": "string", "x-nullable": true }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "notability": { "type": "object", "properties": { "first_seen_target": { "type": "object", "properties": { "label": { "type": "string" }, "targets": { "type": "array", "items": {}, "uniqueItems": true } }, "required": [ "label", "targets" ] }, "severity": { "type": "object", "properties": { "label": { "type": "string" } }, "required": [ "label" ] }, "mitre-attack": { "type": "object", "properties": { "label": { "type": "string" } }, "required": [ "label" ] }, "first_seen_indicator": { "type": "object", "properties": { "label": { "type": "string" }, "indicators": { "type": "array", "items": {}, "uniqueItems": true } }, "required": [ "label", "indicators" ] }, "original_event": { "type": "object", "properties": { "label": { "type": "string" } }, "required": [ "label" ] } } }, "mitreData": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "enum": [ "TA0004", "TA0010", "TA0005", "TA0001", "TA0009", "TA0002", "TA0040", "TA0043", "TA0011", "TA0008", "TA0042", "TA0006", "TA0007", "TA0003" ] }, "value": { "type": "string", "enum": [ "TA0004", "TA0010", "TA0005", "TA0001", "TA0009", "TA0002", "TA0040", "TA0043", "TA0011", "TA0008", "TA0042", "TA0006", "TA0007", "TA0003" ] }, "phase_name": { "type": "string", "enum": [ "privilege-escalation", "exfiltration", "defense-evasion", "initial-access", "collection", "execution", "impact", "reconnaissance", "command-and-control", "lateral-movement", "resource-development", "credential-access", "discovery", "persistence" ] }, "priority": { "type": "integer", "enum": [ 6, 12, 7, 3, 10, 4, 13, 1, 11, 9, 2, 8, 8, 5 ] }, "url": { "type": "string", "enum": [ "https://attack.mitre.org/tactics/TA0004/", "https://attack.mitre.org/tactics/TA0010/", "https://attack.mitre.org/tactics/TA0005/", "https://attack.mitre.org/tactics/TA0001/", "https://attack.mitre.org/tactics/TA0009/", "https://attack.mitre.org/tactics/TA0002/", "https://attack.mitre.org/tactics/TA0040/", "https://attack.mitre.org/tactics/TA0043/", "https://attack.mitre.org/tactics/TA0011/", "https://attack.mitre.org/tactics/TA0008/", "https://attack.mitre.org/tactics/TA0042/", "https://attack.mitre.org/tactics/TA0006/", "https://attack.mitre.org/tactics/TA0007/", "https://attack.mitre.org/tactics/TA0003/" ] }, "title": { "type": "string", "enum": [ "Privilege Escalation", "Exfiltration", "Defense Evasion", "Initial Access", "Collection", "Execution", "Impact", "Reconnaissance", "Command and Control", "Lateral Movement", "Resource Development", "Credential Access", "Discovery", "Persistence" ] } }, "required": [ "id", "value", "phase_name", "priority", "url", "title" ] }, "uniqueItems": true }, "notable": { "type": "boolean" }, "original": { "type": "boolean" }, "indicators": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "indicator" ], "example": "indicator", "description": "The fixed value indicator" }, "schema_version": { "type": "string", "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "x-nullable": true, "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "x-nullable": true, "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "x-nullable": true, "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "x-nullable": true, "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "The time range during which this Indicator is considered valid." }, "producer": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "Critical" }, "negate": { "type": "boolean", "example": true, "description": "Specifies the absence of the pattern." }, "indicator_type": { "type": "array", "items": { "type": "string", "enum": [ "Anonymization", "C2", "Compromised PKI Certificate", "Domain Watchlist", "Exfiltration", "File Hash Watchlist", "Host Characteristics", "IMEI Watchlist", "IMSI Watchlist", "IP Watchlist", "Login Name", "Malicious E-mail", "Malware Artifacts", "Private Threat Feed", "URL Watchlist" ], "example": "Anonymization" }, "example": [ "Anonymization" ], "description": "Specifies the type or types for this Indicator." }, "tags": { "type": "array", "items": { "type": "string" }, "x-nullable": true, "example": [ "string" ], "description": "Descriptors for this indicator." }, "composite_indicator_expression": { "type": "object", "properties": { "operator": { "type": "string", "enum": [ "and", "not", "or" ], "example": "and" }, "indicator_ids": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an indicator." }, "example": [ "string" ] } }, "required": [ "operator", "indicator_ids" ], "example": { "operator": "and", "indicator_ids": [ "string" ] } }, "likely_impact": { "type": "string", "example": "string", "description": "Likely potential impact within the relevant context if this Indicator were to occur." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "level of confidence held in the accuracy of this Indicator." }, "kill_chain_phases": { "type": "array", "items": { "type": "object", "properties": { "kill_chain_name": { "type": "string", "example": "string", "description": "The name of the kill chain." }, "phase_name": { "type": "string", "example": "string", "description": "The name of the phase in the kill chain." } }, "required": [ "kill_chain_name", "phase_name" ], "example": { "kill_chain_name": "string", "phase_name": "string" }, "description": "The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives." }, "example": [ { "kill_chain_name": "string", "phase_name": "string" } ], "description": "Relevant kill chain phases indicated by this Indicator." }, "test_mechanisms": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "example": [ "string" ], "description": "Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator." }, "specification": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Judgement" ], "example": "Judgement" }, "judgements": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to a judgement." }, "example": [ "string" ] }, "required_judgements": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "source": { "type": "string", "example": "string" }, "relationship": { "type": "string", "example": "string" }, "judgement_id": { "type": "string", "example": "string", "description": "A URI leading to a judgement." } }, "required": [ "judgement_id" ], "example": { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } }, "example": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "required": [ "type", "judgements", "required_judgements" ], "example": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] }, "description": "An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.", "x-anyOf": [ { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Judgement" ], "example": "Judgement" }, "judgements": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to a judgement." }, "example": [ "string" ] }, "required_judgements": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "source": { "type": "string", "example": "string" }, "relationship": { "type": "string", "example": "string" }, "judgement_id": { "type": "string", "example": "string", "description": "A URI leading to a judgement." } }, "required": [ "judgement_id" ], "example": { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } }, "example": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "required": [ "type", "judgements", "required_judgements" ], "example": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] }, "description": "An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "ThreatBrain" ], "example": "ThreatBrain" }, "query": { "type": "string", "example": "string" }, "variables": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ] } }, "required": [ "type", "variables" ], "example": { "type": "ThreatBrain", "query": "string", "variables": [ "string" ] }, "description": "An indicator which runs in threatbrain..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Snort" ], "example": "Snort" }, "snort_sig": { "type": "string", "example": "string" } }, "required": [ "type", "snort_sig" ], "example": { "type": "Snort", "snort_sig": "string" }, "description": "An indicator which runs in snort..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "SIOC" ], "example": "SIOC" }, "SIOC": { "type": "string", "example": "string" } }, "required": [ "type", "SIOC" ], "example": { "type": "SIOC", "SIOC": "string" }, "description": "An indicator which runs in snort..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "OpenIOC" ], "example": "OpenIOC" }, "open_IOC": { "type": "string", "example": "string" } }, "required": [ "type", "open_IOC" ], "example": { "type": "OpenIOC", "open_IOC": "string" }, "description": "An indicator which contains an XML blob of an openIOC indicator." } ] }, "value": { "title": "Event.Indicator.Value", "type": "string", "example": "W32.AdditionVariableCommandObfuscation.ioc", "description": "The canonical label for an indicator." } }, "required": [ "id", "producer", "value" ], "example": { "description": "string", "tags": [ "string" ], "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "producer": "string", "schema_version": "1.3.30", "revision": 10, "type": "indicator", "test_mechanisms": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "composite_indicator_expression": { "operator": "and", "indicator_ids": [ "string" ] }, "title": "string", "likely_impact": "string", "indicator_type": [ "Anonymization" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "severity": "Critical", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "negate": true, "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "specification": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "description": "An indicator is a test, or a collection of judgements that define\ncriteria for identifying the activity, or presence of malware, or\nother unwanted software.\n\nWe follow the\n[STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/)\nclosely, with the exception of not including observables within the\nindicator, and preferring a _specification_ object encoded in JSON as\nopposed to an opaque _implementation_ block.\n\nAdditional, you will want to either define judgements against\nObservables that are linked to this indicator, with the ID in the\n_indicators_ field of those Judgements, or you can provide a\n_specification_ value." } }, "investigationId": { "type": "string", "x-nullable": true }, "investigationShortDescription": { "type": "string", "x-nullable": true }, "investigationSource": { "type": "string", "x-nullable": true }, "targets": { "type": "array", "items": { "type": "object", "properties": { "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "type": { "title": "TargetTypeEnum", "type": "string", "enum": [ "device", "person", "user", "email", "endpoint.sensor", "process.network-scanner", "network.switch", "network.security_manager", "process.vulnerability-scanner", "network.hub", "network.ids", "network.firewall", "process", "network.sense_making", "process.sandbox", "network.modem", "process.email-service", "process.dns-server", "network.vpn", "process.connection-scanner", "network.nic", "endpoint.printer", "network.gateway", "process.reputation-service", "process.remediation-service", "network", "process.virtualization-service", "network.ips", "endpoint.smart-meter", "endpoint.digital-telephone-handset", "endpoint.workstation", "endpoint.server", "network.wap", "endpoint.laptop", "process.aaa-server", "process.directory-service", "endpoint.pos-terminal", "network.bridge", "process.file-scanner", "network.proxy", "endpoint", "process.location-service", "network.sensor", "endpoint.smart-phone", "network.hips", "process.anti-virus-scanner", "endpoint.tablet", "network.guard", "network.router" ], "example": "endpoint", "description": "The targe type/actuator that best fits the device." }, "value": { "title": "TargetSummary.Value", "type": "string", "example": "CARGO-Example", "description": "The targe type/actuator that best fits the device." }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The numerical value of the Device. Will Default to 10 if the Target is resolved.", "example": 2, "x-nullable": true, "default": 7 }, "is_asset": { "title": "TargetSummary.IsAssetEnum", "enum": [ true ], "type": "boolean", "example": true, "description": "Always true for targets." }, "observableType": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The observable type of the defining target observable" }, "observables": { "title": "TargetSummary.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true, "description": "The observable type of the defining target observable" }, "asset_id": { "title": "TargetSummary.AssetId", "type": "string", "example": "4911bbf5-aa42-463b-9a47-65f24140cfe4", "description": "The Device/User Insights ID of this Person or Device.", "x-nullable": true }, "properties": { "title": "TargetSummary.Properties", "type": "array", "items": { "type": "object", "properties": { "name": { "title": "Property.Name", "type": "string", "description": "An open vocabulary string that describes the name of the property.", "example": "cisco:ctr:labels" }, "value": { "title": "Property.Value", "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": {} } ], "description": "The value of the named property.", "example": [ "example label", 1, [ "it can be a string or an int or a vector of anything" ] ] } }, "required": [ "name", "value" ] }, "uniqueItems": true, "description": "The List of Device or Person properties for this resolved Person/Device." } }, "required": [ "type", "value", "is_asset", "observableType", "observables", "asset_id", "properties" ] } }, "relations": { "type": "array", "items": { "type": "object", "properties": { "origin": { "type": "string" }, "relation": { "type": "string" }, "related": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ], "x-anyOf": [ { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ] }, { "type": "object", "properties": { "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "type": { "title": "TargetTypeEnum", "type": "string", "enum": [ "device", "person", "user", "email", "endpoint.sensor", "process.network-scanner", "network.switch", "network.security_manager", "process.vulnerability-scanner", "network.hub", "network.ids", "network.firewall", "process", "network.sense_making", "process.sandbox", "network.modem", "process.email-service", "process.dns-server", "network.vpn", "process.connection-scanner", "network.nic", "endpoint.printer", "network.gateway", "process.reputation-service", "process.remediation-service", "network", "process.virtualization-service", "network.ips", "endpoint.smart-meter", "endpoint.digital-telephone-handset", "endpoint.workstation", "endpoint.server", "network.wap", "endpoint.laptop", "process.aaa-server", "process.directory-service", "endpoint.pos-terminal", "network.bridge", "process.file-scanner", "network.proxy", "endpoint", "process.location-service", "network.sensor", "endpoint.smart-phone", "network.hips", "process.anti-virus-scanner", "endpoint.tablet", "network.guard", "network.router" ], "example": "endpoint", "description": "The targe type/actuator that best fits the device." }, "value": { "title": "TargetSummary.Value", "type": "string", "example": "CARGO-Example", "description": "The targe type/actuator that best fits the device." }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The numerical value of the Device. Will Default to 10 if the Target is resolved.", "example": 2, "x-nullable": true, "default": 7 }, "is_asset": { "title": "TargetSummary.IsAssetEnum", "enum": [ true ], "type": "boolean", "example": true, "description": "Always true for targets." }, "observableType": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The observable type of the defining target observable" }, "observables": { "title": "TargetSummary.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true, "description": "The observable type of the defining target observable" }, "asset_id": { "title": "TargetSummary.AssetId", "type": "string", "example": "4911bbf5-aa42-463b-9a47-65f24140cfe4", "description": "The Device/User Insights ID of this Person or Device.", "x-nullable": true }, "properties": { "title": "TargetSummary.Properties", "type": "array", "items": { "type": "object", "properties": { "name": { "title": "Property.Name", "type": "string", "description": "An open vocabulary string that describes the name of the property.", "example": "cisco:ctr:labels" }, "value": { "title": "Property.Value", "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": {} } ], "description": "The value of the named property.", "example": [ "example label", 1, [ "it can be a string or an int or a vector of anything" ] ] } }, "required": [ "name", "value" ] }, "uniqueItems": true, "description": "The List of Device or Person properties for this resolved Person/Device." } }, "required": [ "type", "value", "is_asset", "observableType", "observables", "asset_id", "properties" ] } ] }, "source": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ], "x-anyOf": [ { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ] }, { "type": "object", "properties": { "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "type": { "title": "TargetTypeEnum", "type": "string", "enum": [ "device", "person", "user", "email", "endpoint.sensor", "process.network-scanner", "network.switch", "network.security_manager", "process.vulnerability-scanner", "network.hub", "network.ids", "network.firewall", "process", "network.sense_making", "process.sandbox", "network.modem", "process.email-service", "process.dns-server", "network.vpn", "process.connection-scanner", "network.nic", "endpoint.printer", "network.gateway", "process.reputation-service", "process.remediation-service", "network", "process.virtualization-service", "network.ips", "endpoint.smart-meter", "endpoint.digital-telephone-handset", "endpoint.workstation", "endpoint.server", "network.wap", "endpoint.laptop", "process.aaa-server", "process.directory-service", "endpoint.pos-terminal", "network.bridge", "process.file-scanner", "network.proxy", "endpoint", "process.location-service", "network.sensor", "endpoint.smart-phone", "network.hips", "process.anti-virus-scanner", "endpoint.tablet", "network.guard", "network.router" ], "example": "endpoint", "description": "The targe type/actuator that best fits the device." }, "value": { "title": "TargetSummary.Value", "type": "string", "example": "CARGO-Example", "description": "The targe type/actuator that best fits the device." }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The numerical value of the Device. Will Default to 10 if the Target is resolved.", "example": 2, "x-nullable": true, "default": 7 }, "is_asset": { "title": "TargetSummary.IsAssetEnum", "enum": [ true ], "type": "boolean", "example": true, "description": "Always true for targets." }, "observableType": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The observable type of the defining target observable" }, "observables": { "title": "TargetSummary.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true, "description": "The observable type of the defining target observable" }, "asset_id": { "title": "TargetSummary.AssetId", "type": "string", "example": "4911bbf5-aa42-463b-9a47-65f24140cfe4", "description": "The Device/User Insights ID of this Person or Device.", "x-nullable": true }, "properties": { "title": "TargetSummary.Properties", "type": "array", "items": { "type": "object", "properties": { "name": { "title": "Property.Name", "type": "string", "description": "An open vocabulary string that describes the name of the property.", "example": "cisco:ctr:labels" }, "value": { "title": "Property.Value", "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": {} } ], "description": "The value of the named property.", "example": [ "example label", 1, [ "it can be a string or an int or a vector of anything" ] ] } }, "required": [ "name", "value" ] }, "uniqueItems": true, "description": "The List of Device or Person properties for this resolved Person/Device." } }, "required": [ "type", "value", "is_asset", "observableType", "observables", "asset_id", "properties" ] } ] }, "origin_uri": { "type": "string" }, "relation_info": {} }, "required": [ "origin", "relation", "related", "source" ] } }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ] } }, "tactics_and_techniques": { "type": "array", "items": { "title": "Mitre tactics and Techniques", "type": "object", "properties": { "id": { "title": "MitreID", "type": "string", "example": "TA0003", "description": "MITRE ATT&CK ID" }, "external_id": { "title": "MitreExternalId", "type": "string", "example": "TA0003", "description": "MITRE ATT&CK ID" }, "title": { "title": "MitreTitle", "type": "string", "example": "Persistence" }, "short_description": { "title": "MitreShortDescription", "type": "string", "x-nullable": true, "example": "Persistence" }, "description": { "title": "MitreDescription", "type": "string", "example": "The adversary is trying to maintain their foothold.\n\nPersistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code." }, "score": { "title": "MitreScore", "type": "integer", "format": "int64", "minimum": 1, "maximum": 1000, "x-nullable": true, "example": 44 }, "source_url": { "title": "MitreSourceURL", "type": "string", "x-nullable": true, "example": "https://attack.mitre.org/techniques/TA0003", "description": "The source url for this tactic or technique" }, "mitre_type": { "type": "string", "enum": [ "tactic", "technique", "subtechnique" ] } }, "required": [ "id", "external_id", "title", "short_description", "description", "score", "source_url", "mitre_type" ], "description": "A MITRE object from https://attack.mitre.org/" } } }, "required": [ "confidence", "count", "id", "observed_time", "type", "notable", "original", "targets", "relations", "observables" ] } } }, "required": [ "events" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v1" ], "summary": "Incident Events", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/casebook": { "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "201": { "schema": { "type": "object", "properties": { "bundle": { "type": "object", "properties": { "id": { "type": "string" }, "description": { "type": "string" }, "attack_patterns": { "type": "array", "items": { "type": "object", "properties": {} } }, "assets": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_properties": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_mappings": { "type": "array", "items": { "type": "object", "properties": {} } }, "casebooks": { "type": "array", "items": { "type": "object", "properties": {} } }, "indicators": { "type": "array", "items": { "type": "object", "properties": {} } }, "judgements": { "type": "array", "items": { "type": "object", "properties": {} } }, "malwares": { "type": "array", "items": { "type": "object", "properties": {} } }, "modules": { "type": "array", "items": { "type": "object", "properties": {} } }, "relationships": { "type": "array", "items": { "type": "object", "properties": {} } }, "sightings": { "type": "array", "items": { "type": "object", "properties": {} } }, "verdicts": { "type": "array", "items": { "type": "object", "properties": {} } }, "tools": { "type": "array", "items": { "type": "object", "properties": {} } } } }, "texts": { "type": "array", "items": { "type": "object", "properties": { "text": { "type": "string" }, "type": { "type": "string" } }, "required": [ "text", "type" ] } }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "casebook" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "id", "groups", "schema_version", "type" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "bundle": { "type": "object", "properties": { "id": { "type": "string" }, "description": { "type": "string" }, "attack_patterns": { "type": "array", "items": { "type": "object", "properties": {} } }, "assets": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_properties": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_mappings": { "type": "array", "items": { "type": "object", "properties": {} } }, "casebooks": { "type": "array", "items": { "type": "object", "properties": {} } }, "indicators": { "type": "array", "items": { "type": "object", "properties": {} } }, "judgements": { "type": "array", "items": { "type": "object", "properties": {} } }, "malwares": { "type": "array", "items": { "type": "object", "properties": {} } }, "modules": { "type": "array", "items": { "type": "object", "properties": {} } }, "relationships": { "type": "array", "items": { "type": "object", "properties": {} } }, "sightings": { "type": "array", "items": { "type": "object", "properties": {} } }, "verdicts": { "type": "array", "items": { "type": "object", "properties": {} } }, "tools": { "type": "array", "items": { "type": "object", "properties": {} } } } }, "texts": { "type": "array", "items": { "type": "object", "properties": { "text": { "type": "string" }, "type": { "type": "string" } }, "required": [ "text", "type" ] } }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] } } } } ], "tags": [ "v2", "Casebook" ], "summary": "Adds a new Casebook", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] }, { "JWT-Bearer": [] } ] } }, "/v2/casebook/external_id/{external-id}": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "headers": [ "map", [ "x-sort", { "optional": true }, [ "maybe", [ "vector", "any" ] ] ], [ "x-next", { "optional": true }, "string" ], [ "x-total-hits", { "optional": true }, [ "int", { "title": "PositiveInteger", "json-schema/description": "A integer greater than 0.", "json-schema/example": 2, "min": 0 } ] ] ], "schema": { "type": "array", "items": { "type": "object", "properties": { "bundle": { "type": "object", "properties": { "id": { "type": "string" }, "description": { "type": "string" }, "attack_patterns": { "type": "array", "items": { "type": "object", "properties": {} } }, "assets": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_properties": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_mappings": { "type": "array", "items": { "type": "object", "properties": {} } }, "casebooks": { "type": "array", "items": { "type": "object", "properties": {} } }, "indicators": { "type": "array", "items": { "type": "object", "properties": {} } }, "judgements": { "type": "array", "items": { "type": "object", "properties": {} } }, "malwares": { "type": "array", "items": { "type": "object", "properties": {} } }, "modules": { "type": "array", "items": { "type": "object", "properties": {} } }, "relationships": { "type": "array", "items": { "type": "object", "properties": {} } }, "sightings": { "type": "array", "items": { "type": "object", "properties": {} } }, "verdicts": { "type": "array", "items": { "type": "object", "properties": {} } }, "tools": { "type": "array", "items": { "type": "object", "properties": {} } } } }, "texts": { "type": "array", "items": { "type": "object", "properties": { "text": { "type": "string" }, "type": { "type": "string" } }, "required": [ "text", "type" ] } }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "casebook" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "id", "groups", "schema_version", "type" ] } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "external-id", "description": "", "type": "string", "required": true }, { "in": "query", "name": "sort_by", "description": "Sort result on fields.\n\nThe following fields are supported:\nid, language, revision, schema_version, source, source_uri, timestamp, title, tlp\n\nFields can be combined with ',' and sort order can be\nspecified by ':asc' and ':desc'. For example:\n- id # sort by id ascending\n- id:desc # sort by id descending\n- id,language:desc # sort by id ascending, then language descending", "type": "string", "required": false }, { "in": "query", "name": "sort_order", "description": "", "type": "string", "required": false, "enum": [ "asc", "desc" ] }, { "description": "A integer greater than 0.", "format": "int64", "name": "offset", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "description": "A integer greater than 0.", "format": "int64", "name": "limit", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "in": "query", "name": "search_after", "description": "", "type": "array", "required": false, "items": { "type": "string" }, "x-anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "string" } ], "allowEmptyValue": true }, { "in": "query", "name": "fields", "description": "", "type": "array", "required": false, "items": { "type": "string", "enum": [ "schema_version", "revision", "source", "title", "source_uri", "language", "id", "tlp", "timestamp" ] }, "x-anyOf": [ { "type": "array", "items": { "type": "string", "enum": [ "schema_version", "revision", "source", "title", "source_uri", "language", "id", "tlp", "timestamp" ] } }, { "type": "string" } ], "allowEmptyValue": true } ], "tags": [ "v2", "Casebook" ], "summary": "List Casebook by external id", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] }, { "JWT-Bearer": [] } ] } }, "/v2/casebook/search": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "headers": [ "map", [ "x-sort", { "optional": true }, [ "maybe", [ "vector", "any" ] ] ], [ "x-next", { "optional": true }, "string" ], [ "x-total-hits", { "optional": true }, [ "int", { "title": "PositiveInteger", "json-schema/description": "A integer greater than 0.", "json-schema/example": 2, "min": 0 } ] ] ], "schema": { "type": "array", "items": { "type": "object", "properties": { "bundle": { "type": "object", "properties": { "id": { "type": "string" }, "description": { "type": "string" }, "attack_patterns": { "type": "array", "items": { "type": "object", "properties": {} } }, "assets": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_properties": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_mappings": { "type": "array", "items": { "type": "object", "properties": {} } }, "casebooks": { "type": "array", "items": { "type": "object", "properties": {} } }, "indicators": { "type": "array", "items": { "type": "object", "properties": {} } }, "judgements": { "type": "array", "items": { "type": "object", "properties": {} } }, "malwares": { "type": "array", "items": { "type": "object", "properties": {} } }, "modules": { "type": "array", "items": { "type": "object", "properties": {} } }, "relationships": { "type": "array", "items": { "type": "object", "properties": {} } }, "sightings": { "type": "array", "items": { "type": "object", "properties": {} } }, "verdicts": { "type": "array", "items": { "type": "object", "properties": {} } }, "tools": { "type": "array", "items": { "type": "object", "properties": {} } } } }, "texts": { "type": "array", "items": { "type": "object", "properties": { "text": { "type": "string" }, "type": { "type": "string" } }, "required": [ "text", "type" ] } }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "casebook" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "id", "groups", "schema_version", "type" ] } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "query", "name": "sort_by", "description": "Sort result on fields.\n\nThe following fields are supported:\nid, language, revision, schema_version, source, source_uri, timestamp, title, tlp\n\nFields can be combined with ',' and sort order can be\nspecified by ':asc' and ':desc'. For example:\n- id # sort by id ascending\n- id:desc # sort by id descending\n- id,language:desc # sort by id ascending, then language descending", "type": "string", "required": false }, { "in": "query", "name": "sort_order", "description": "", "type": "string", "required": false, "enum": [ "asc", "desc" ] }, { "description": "A integer greater than 0.", "format": "int64", "name": "offset", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "description": "A integer greater than 0.", "format": "int64", "name": "limit", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "in": "query", "name": "search_after", "description": "", "type": "array", "required": false, "items": { "type": "string" }, "x-anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "string" } ], "allowEmptyValue": true }, { "in": "query", "name": "fields", "description": "", "type": "array", "required": false, "items": { "type": "string", "enum": [ "schema_version", "revision", "source", "title", "source_uri", "language", "id", "tlp", "timestamp" ] }, "x-anyOf": [ { "type": "array", "items": { "type": "string", "enum": [ "schema_version", "revision", "source", "title", "source_uri", "language", "id", "tlp", "timestamp" ] } }, { "type": "string" } ], "allowEmptyValue": true }, { "in": "query", "name": "tlp", "description": "", "type": "string", "required": false, "enum": [ "amber", "green", "red", "white" ] }, { "in": "query", "name": "from", "description": "", "type": "string", "required": false, "format": "date-time" }, { "in": "query", "name": "to", "description": "", "type": "string", "required": false, "format": "date-time" }, { "in": "query", "name": "language", "description": "", "type": "string", "required": false }, { "in": "query", "name": "id", "description": "", "type": "string", "required": false }, { "in": "query", "name": "search_fields", "description": "", "type": "string", "required": false, "enum": [ "id", "short_description", "observables.value", "title", "source", "description" ], "x-anyOf": [ { "type": "string", "enum": [ "id", "short_description", "observables.value", "title", "source", "description" ] }, { "type": "string" } ], "allowEmptyValue": true }, { "in": "query", "name": "source", "description": "", "type": "string", "required": false }, { "in": "query", "name": "query", "description": "", "type": "string", "required": false }, { "in": "query", "name": "simple_query", "description": "Query String with simple query format", "type": "string", "required": false }, { "description": "A integer greater than 0.", "format": "int64", "name": "revision", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "in": "query", "name": "texts.text", "description": "", "type": "string", "required": false } ], "tags": [ "v2", "Casebook" ], "summary": "Search casebooks", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] }, { "JWT-Bearer": [] } ] } }, "/v2/casebook/{casebook-id}": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "bundle": { "type": "object", "properties": { "id": { "type": "string" }, "description": { "type": "string" }, "attack_patterns": { "type": "array", "items": { "type": "object", "properties": {} } }, "assets": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_properties": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_mappings": { "type": "array", "items": { "type": "object", "properties": {} } }, "casebooks": { "type": "array", "items": { "type": "object", "properties": {} } }, "indicators": { "type": "array", "items": { "type": "object", "properties": {} } }, "judgements": { "type": "array", "items": { "type": "object", "properties": {} } }, "malwares": { "type": "array", "items": { "type": "object", "properties": {} } }, "modules": { "type": "array", "items": { "type": "object", "properties": {} } }, "relationships": { "type": "array", "items": { "type": "object", "properties": {} } }, "sightings": { "type": "array", "items": { "type": "object", "properties": {} } }, "verdicts": { "type": "array", "items": { "type": "object", "properties": {} } }, "tools": { "type": "array", "items": { "type": "object", "properties": {} } } } }, "texts": { "type": "array", "items": { "type": "object", "properties": { "text": { "type": "string" }, "type": { "type": "string" } }, "required": [ "text", "type" ] } }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "casebook" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "id", "groups", "schema_version", "type" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "casebook-id", "description": "The casebook in scope", "type": "string", "required": true, "example": "casebook-8d148239-8fda-4fe8-973e-3f181396101f" } ], "tags": [ "v2", "Casebook" ], "summary": "Get one casebook by id", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] }, { "JWT-Bearer": [] } ] }, "put": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "bundle": { "type": "object", "properties": { "id": { "type": "string" }, "description": { "type": "string" }, "attack_patterns": { "type": "array", "items": { "type": "object", "properties": {} } }, "assets": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_properties": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_mappings": { "type": "array", "items": { "type": "object", "properties": {} } }, "casebooks": { "type": "array", "items": { "type": "object", "properties": {} } }, "indicators": { "type": "array", "items": { "type": "object", "properties": {} } }, "judgements": { "type": "array", "items": { "type": "object", "properties": {} } }, "malwares": { "type": "array", "items": { "type": "object", "properties": {} } }, "modules": { "type": "array", "items": { "type": "object", "properties": {} } }, "relationships": { "type": "array", "items": { "type": "object", "properties": {} } }, "sightings": { "type": "array", "items": { "type": "object", "properties": {} } }, "verdicts": { "type": "array", "items": { "type": "object", "properties": {} } }, "tools": { "type": "array", "items": { "type": "object", "properties": {} } } } }, "texts": { "type": "array", "items": { "type": "object", "properties": { "text": { "type": "string" }, "type": { "type": "string" } }, "required": [ "text", "type" ] } }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "casebook" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "id", "groups", "schema_version", "type" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "casebook-id", "description": "The casebook in scope", "type": "string", "required": true, "example": "casebook-8d148239-8fda-4fe8-973e-3f181396101f" }, { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "bundle": { "type": "object", "properties": { "id": { "type": "string" }, "description": { "type": "string" }, "attack_patterns": { "type": "array", "items": { "type": "object", "properties": {} } }, "assets": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_properties": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_mappings": { "type": "array", "items": { "type": "object", "properties": {} } }, "casebooks": { "type": "array", "items": { "type": "object", "properties": {} } }, "indicators": { "type": "array", "items": { "type": "object", "properties": {} } }, "judgements": { "type": "array", "items": { "type": "object", "properties": {} } }, "malwares": { "type": "array", "items": { "type": "object", "properties": {} } }, "modules": { "type": "array", "items": { "type": "object", "properties": {} } }, "relationships": { "type": "array", "items": { "type": "object", "properties": {} } }, "sightings": { "type": "array", "items": { "type": "object", "properties": {} } }, "verdicts": { "type": "array", "items": { "type": "object", "properties": {} } }, "tools": { "type": "array", "items": { "type": "object", "properties": {} } } } }, "texts": { "type": "array", "items": { "type": "object", "properties": { "text": { "type": "string" }, "type": { "type": "string" } }, "required": [ "text", "type" ] } }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] } } } } ], "tags": [ "v2", "Casebook" ], "summary": "Updates a Casebook", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] }, { "JWT-Bearer": [] } ] }, "delete": { "responses": { "204": { "schema": {}, "description": "" }, "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "casebook-id", "description": "The casebook in scope", "type": "string", "required": true, "example": "casebook-8d148239-8fda-4fe8-973e-3f181396101f" } ], "tags": [ "v2", "Casebook" ], "summary": "Deletes a Casebook", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] }, { "JWT-Bearer": [] } ] }, "patch": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "bundle": { "type": "object", "properties": { "id": { "type": "string" }, "description": { "type": "string" }, "attack_patterns": { "type": "array", "items": { "type": "object", "properties": {} } }, "assets": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_properties": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_mappings": { "type": "array", "items": { "type": "object", "properties": {} } }, "casebooks": { "type": "array", "items": { "type": "object", "properties": {} } }, "indicators": { "type": "array", "items": { "type": "object", "properties": {} } }, "judgements": { "type": "array", "items": { "type": "object", "properties": {} } }, "malwares": { "type": "array", "items": { "type": "object", "properties": {} } }, "modules": { "type": "array", "items": { "type": "object", "properties": {} } }, "relationships": { "type": "array", "items": { "type": "object", "properties": {} } }, "sightings": { "type": "array", "items": { "type": "object", "properties": {} } }, "verdicts": { "type": "array", "items": { "type": "object", "properties": {} } }, "tools": { "type": "array", "items": { "type": "object", "properties": {} } } } }, "texts": { "type": "array", "items": { "type": "object", "properties": { "text": { "type": "string" }, "type": { "type": "string" } }, "required": [ "text", "type" ] } }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "casebook" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "id", "groups", "schema_version", "type" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "casebook-id", "description": "The casebook in scope", "type": "string", "required": true, "example": "casebook-8d148239-8fda-4fe8-973e-3f181396101f" }, { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "bundle": { "type": "object", "properties": { "id": { "type": "string" }, "description": { "type": "string" }, "attack_patterns": { "type": "array", "items": { "type": "object", "properties": {} } }, "assets": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_properties": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_mappings": { "type": "array", "items": { "type": "object", "properties": {} } }, "casebooks": { "type": "array", "items": { "type": "object", "properties": {} } }, "indicators": { "type": "array", "items": { "type": "object", "properties": {} } }, "judgements": { "type": "array", "items": { "type": "object", "properties": {} } }, "malwares": { "type": "array", "items": { "type": "object", "properties": {} } }, "modules": { "type": "array", "items": { "type": "object", "properties": {} } }, "relationships": { "type": "array", "items": { "type": "object", "properties": {} } }, "sightings": { "type": "array", "items": { "type": "object", "properties": {} } }, "verdicts": { "type": "array", "items": { "type": "object", "properties": {} } }, "tools": { "type": "array", "items": { "type": "object", "properties": {} } } } }, "texts": { "type": "array", "items": { "type": "object", "properties": { "text": { "type": "string" }, "type": { "type": "string" } }, "required": [ "text", "type" ] } }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] } } } } ], "tags": [ "v2", "Casebook" ], "summary": "Partially Update a Casebook", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] }, { "JWT-Bearer": [] } ] } }, "/v2/casebook/{casebook-id}/summary": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "bundle": { "type": "object", "properties": { "id": { "type": "string" }, "description": { "type": "string" }, "attack_patterns": { "type": "array", "items": { "type": "object", "properties": {} } }, "assets": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_properties": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_mappings": { "type": "array", "items": { "type": "object", "properties": {} } }, "casebooks": { "type": "array", "items": { "type": "object", "properties": {} } }, "indicators": { "type": "array", "items": { "type": "object", "properties": {} } }, "judgements": { "type": "array", "items": { "type": "object", "properties": {} } }, "malwares": { "type": "array", "items": { "type": "object", "properties": {} } }, "modules": { "type": "array", "items": { "type": "object", "properties": {} } }, "relationships": { "type": "array", "items": { "type": "object", "properties": {} } }, "sightings": { "type": "array", "items": { "type": "object", "properties": {} } }, "verdicts": { "type": "array", "items": { "type": "object", "properties": {} } }, "tools": { "type": "array", "items": { "type": "object", "properties": {} } } } }, "texts": { "type": "array", "items": { "type": "object", "properties": { "text": { "type": "string" }, "type": { "type": "string" } }, "required": [ "text", "type" ] } }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "casebook" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "incidents": { "type": "array", "items": { "type": "object", "properties": { "assignees": { "type": "array", "items": { "type": "string" } }, "categories": { "type": "array", "items": { "type": "string", "enum": [ "Attrition", "Denial of Service", "Exercise", "Exercise/Network Defense Testing", "Explained Anomaly", "Forensics", "Improper Usage", "Intelligence", "Investigating", "Investigation", "Malicious Code", "Malicious Logic", "Non-Compliant", "Reconnaissance", "Root Level", "Scans/Probes/Attempted Access", "Unauthorized Access", "Unsuccessful", "User Level", "eDiscovery" ] } }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "detection_sources": { "type": "array", "items": { "type": "string" } }, "detection_status": { "title": "DetectionStatusType", "type": "string", "enum": [ "active", "inactive_merged", "inactive_expired", "inactive_oversized", "inactive_user_closed" ], "description": "Whether the incident is actively receiving detection data updates" }, "discovery_method": { "type": "string", "enum": [ "SecureX Threat Hunting", "Agent Disclosure", "Antivirus", "Audit", "Customer", "External - Fraud Detection", "Financial Audit", "HIPS", "IT Audit", "Incident Response", "Internal - Fraud Detection", "Law Enforcement", "Log Review", "Monitoring Service", "NIDS", "Security Alarm", "Unknown", "Unrelated Party", "User" ] }, "incident_time": { "type": "object", "properties": { "opened": { "type": "string" }, "closed": { "type": "string" }, "discovered": { "type": "string" }, "rejected": { "type": "string" }, "remediated": { "type": "string" }, "reported": { "type": "string" } }, "required": [ "opened" ] }, "intended_effect": { "type": "string", "enum": [ "Account Takeover", "Advantage", "Advantage - Economic", "Advantage - Military", "Advantage - Political", "Brand Damage", "Competitive Advantage", "Degradation of Service", "Denial and Deception", "Destruction", "Disruption", "Embarrassment", "Exposure", "Extortion", "Fraud", "Harassment", "ICS Control", "Theft", "Theft - Credential Theft", "Theft - Identity Theft", "Theft - Intellectual Property", "Theft - Theft of Proprietary Information", "Traffic Diversion", "Unauthorized Access" ] }, "meta": { "type": "object", "properties": { "ai_description": { "type": "boolean" }, "helios_report_generated": { "type": "boolean" } } }, "promotion_method": { "type": "string", "enum": [ "Automated", "Manual" ] }, "scores": { "type": "object", "properties": { "asset": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 10 }, "global": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 1000 }, "ml_score": { "type": "number", "format": "double" }, "ttp": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 100 } } }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_id": { "type": "string" }, "status": { "title": "IncidentStatusType", "type": "string", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ], "description": "The status of the incident" }, "tactics": { "type": "array", "items": { "type": "string" } }, "techniques": { "type": "array", "items": { "type": "string" } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "incident" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "confidence", "incident_time", "status", "id", "groups", "schema_version", "type" ] } } }, "required": [ "id", "groups", "schema_version", "type", "incidents" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "casebook-id", "description": "The casebook in scope", "type": "string", "required": true, "example": "casebook-8d148239-8fda-4fe8-973e-3f181396101f" } ], "tags": [ "v2", "Casebook" ], "summary": "Returns a casebook and it's related incidents.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] }, { "JWT-Bearer": [] } ] } }, "/v2/casebook/{casebook-id}/observables": { "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "bundle": { "type": "object", "properties": { "id": { "type": "string" }, "description": { "type": "string" }, "attack_patterns": { "type": "array", "items": { "type": "object", "properties": {} } }, "assets": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_properties": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_mappings": { "type": "array", "items": { "type": "object", "properties": {} } }, "casebooks": { "type": "array", "items": { "type": "object", "properties": {} } }, "indicators": { "type": "array", "items": { "type": "object", "properties": {} } }, "judgements": { "type": "array", "items": { "type": "object", "properties": {} } }, "malwares": { "type": "array", "items": { "type": "object", "properties": {} } }, "modules": { "type": "array", "items": { "type": "object", "properties": {} } }, "relationships": { "type": "array", "items": { "type": "object", "properties": {} } }, "sightings": { "type": "array", "items": { "type": "object", "properties": {} } }, "verdicts": { "type": "array", "items": { "type": "object", "properties": {} } }, "tools": { "type": "array", "items": { "type": "object", "properties": {} } } } }, "texts": { "type": "array", "items": { "type": "object", "properties": { "text": { "type": "string" }, "type": { "type": "string" } }, "required": [ "text", "type" ] } }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "casebook" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "id", "groups", "schema_version", "type" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "casebook-id", "description": "The casebook in scope", "type": "string", "required": true, "example": "casebook-8d148239-8fda-4fe8-973e-3f181396101f" }, { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "operation": { "type": "string", "enum": [ "add", "remove", "replace" ] }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } } }, "required": [ "operation", "observables" ] } } ], "tags": [ "v2", "Casebook" ], "summary": "Updates a casebook's observables", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] }, { "JWT-Bearer": [] } ] } }, "/v2/casebook/{casebook-id}/bundle": { "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "bundle": { "type": "object", "properties": { "id": { "type": "string" }, "description": { "type": "string" }, "attack_patterns": { "type": "array", "items": { "type": "object", "properties": {} } }, "assets": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_properties": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_mappings": { "type": "array", "items": { "type": "object", "properties": {} } }, "casebooks": { "type": "array", "items": { "type": "object", "properties": {} } }, "indicators": { "type": "array", "items": { "type": "object", "properties": {} } }, "judgements": { "type": "array", "items": { "type": "object", "properties": {} } }, "malwares": { "type": "array", "items": { "type": "object", "properties": {} } }, "modules": { "type": "array", "items": { "type": "object", "properties": {} } }, "relationships": { "type": "array", "items": { "type": "object", "properties": {} } }, "sightings": { "type": "array", "items": { "type": "object", "properties": {} } }, "verdicts": { "type": "array", "items": { "type": "object", "properties": {} } }, "tools": { "type": "array", "items": { "type": "object", "properties": {} } } } }, "texts": { "type": "array", "items": { "type": "object", "properties": { "text": { "type": "string" }, "type": { "type": "string" } }, "required": [ "text", "type" ] } }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "casebook" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "id", "groups", "schema_version", "type" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "casebook-id", "description": "The casebook in scope", "type": "string", "required": true, "example": "casebook-8d148239-8fda-4fe8-973e-3f181396101f" }, { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "operation": { "type": "string", "enum": [ "add", "remove", "replace" ] }, "bundle": {} }, "required": [ "operation", "bundle" ] } } ], "tags": [ "v2", "Casebook" ], "summary": "Updates a casebook's bundle", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] }, { "JWT-Bearer": [] } ] } }, "/v2/casebook/{casebook-id}/texts": { "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "bundle": { "type": "object", "properties": { "id": { "type": "string" }, "description": { "type": "string" }, "attack_patterns": { "type": "array", "items": { "type": "object", "properties": {} } }, "assets": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_properties": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_mappings": { "type": "array", "items": { "type": "object", "properties": {} } }, "casebooks": { "type": "array", "items": { "type": "object", "properties": {} } }, "indicators": { "type": "array", "items": { "type": "object", "properties": {} } }, "judgements": { "type": "array", "items": { "type": "object", "properties": {} } }, "malwares": { "type": "array", "items": { "type": "object", "properties": {} } }, "modules": { "type": "array", "items": { "type": "object", "properties": {} } }, "relationships": { "type": "array", "items": { "type": "object", "properties": {} } }, "sightings": { "type": "array", "items": { "type": "object", "properties": {} } }, "verdicts": { "type": "array", "items": { "type": "object", "properties": {} } }, "tools": { "type": "array", "items": { "type": "object", "properties": {} } } } }, "texts": { "type": "array", "items": { "type": "object", "properties": { "text": { "type": "string" }, "type": { "type": "string" } }, "required": [ "text", "type" ] } }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "casebook" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "id", "groups", "schema_version", "type" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "casebook-id", "description": "The casebook in scope", "type": "string", "required": true, "example": "casebook-8d148239-8fda-4fe8-973e-3f181396101f" }, { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "operation": { "type": "string", "enum": [ "add", "remove", "replace" ] }, "texts": { "type": "array", "items": { "type": "object", "properties": { "text": { "type": "string" }, "type": { "type": "string" } }, "required": [ "text", "type" ] } } }, "required": [ "operation", "texts" ] } } ], "tags": [ "v2", "Casebook" ], "summary": "Updates a casebook's texts", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] }, { "JWT-Bearer": [] } ] } }, "/v2/investigation": { "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "investigation_id": { "type": "string", "format": "uuid" } }, "required": [ "investigation_id" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "observables": { "title": "ObservablesList", "description": "Observables that will be investigated", "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." } }, "modules": { "title": "Modules", "description": "Module Ids that will be called during investigation for iroh-enrich.", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." } }, "time_window": { "title": "TimeWindow", "description": "A window of start_time to end_time to filter returned sightings.", "type": "object", "properties": { "start_time": { "title": "StartTime", "description": "Return events after this time.", "type": "string", "format": "date-time", "example": "2026-08-18T22:03:32.803876481Z" }, "end_time": { "title": "EndTime", "description": "Will be used to filter Events that occurred before this time (defaults to now)", "type": "string", "format": "date-time", "example": "2026-08-18T22:03:32.803889681Z" } }, "required": [ "start_time" ] }, "source": { "title": "InvestigationSource", "description": "String with at most 1024 characters.", "type": "string", "example": "Cisco XDR Automated Question" }, "title": { "title": "InvestigationTitle", "description": "String with at most 1024 characters.", "type": "string", "example": "Which devices in my org was this sha seen on?" }, "description": { "title": "InvestigationDescription", "description": "String with at most 5000 characters.", "type": "string", "example": "For the following hashes:\n- sha256:defg...1234\n- sha256:abcd..1234\n\nDetermine which devices in my org have instances of the file in the past 30 days" } }, "required": [ "observables" ] } } ], "tags": [ "v2", "Investigation Creation" ], "summary": "Create Investigation", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/investigation/bundle": { "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "investigation_id": { "type": "string", "format": "uuid" }, "created_threat_object_counts": { "type": "object", "properties": { "sightings": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "indicators": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "verdicts": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "judgements": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "malwares": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "tools": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "attack_patterns": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "assets": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "sightings", "indicators", "verdicts", "judgements", "malwares", "tools", "attack_patterns", "assets" ] } }, "required": [ "investigation_id", "created_threat_object_counts" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "bundle": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "bundle" ], "example": "bundle", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "actors": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "actor" ], "example": "actor", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Indicates the time span for which the information about the Actor is relevant, and after which it could become outdated." }, "actor_types": { "type": "array", "items": { "type": "string", "example": "Cyber Espionage Operations" }, "example": [ "Cyber Espionage Operations" ] }, "identity": { "type": "object", "properties": { "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "related_identities": { "type": "array", "items": { "type": "object", "properties": { "identity": { "type": "string", "example": "string", "description": "The reference (URI) of the related Identity object." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "Specifies the level of confidence in the assertion of the relationship between the two objects." }, "information_source": { "type": "string", "example": "string", "description": "Specifies the source of the information about the relationship between the two components." }, "relationship": { "type": "string", "example": "string" } }, "required": [ "identity" ], "example": { "identity": "string", "confidence": "High", "information_source": "string", "relationship": "string" }, "description": "Describes a related Identity" }, "example": [ { "identity": "string", "confidence": "High", "information_source": "string", "relationship": "string" } ], "description": "Identifies other entity Identities related to this Identity." } }, "required": [ "description", "related_identities" ], "example": { "description": "string", "related_identities": [ { "identity": "string", "confidence": "High", "information_source": "string", "relationship": "string" } ] }, "description": "Can contain information such as the name of the attacker, the group or organization they belong to, or any other identifier that can help in the attribution process." }, "motivation": { "type": "string", "example": "Ego", "description": "The reason or purpose behind the malicious activity attributed to this Actor. By understanding a threat actor's motivation, analysts can better predict the attacker's behavior and anticipate future malicious actions." }, "sophistication": { "type": "string", "enum": [ "Aspirant", "Expert", "Innovator", "Novice", "Practitioner" ], "example": "Aspirant", "description": "Represents the level of expertise and skill that the threat actor has displayed in their malicious activities. Can help security analysts assess the potential impact of an attacker's TTPs and determine the potential attack surface. \n\nFor example, a threat actor with a low sophistication level may primarily rely on off-the-shelf malware and attack tools, while an attacker with high sophistication may use custom tools with advanced evasion techniques, zero-day exploits, and sophisticated methods for command and control of their malware. \n\nThe sophistication level of an attacker can also be inferred based on several factors such as the complexity of attacks, the attacker's knowledge of the targeted organization's systems, and the attacker's ability to remain undetected.\n\nIf an attacker shows a high level of sophistication in reconnaissances, social engineering, and phishing, then the attacker may have a good knowledge of the targeted organization and its employees. This means that the attacker may be more successful in infiltrating the organization's network and compromising its systems." }, "intended_effect": { "type": "string", "example": "Account Takeover", "description": "Represents the desired outcome or impact the threat actor is trying to achieve through their malicious activities. \n\n Helps security analysts to understand the attacker's goals beyond the immediate impact of the attack. By understanding the intended effect, analysts can draw connections between seemingly unrelated attacks and build a more complete understanding of an attacker's long-term goals and motivations." }, "planning_and_operational_support": { "type": "string", "example": "string", "description": "Provides information about the resources and capabilities of the attacker that could be used to assist in planning and operations related to the threat.\n\n It can be used to describe Infrastructure, Tools, Techniques, and Capabilities used by the threat actor." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "This field can help analysts decide how much trust they can put in the information provided by the threat intelligence sources.\n\nFor example, an Actor entity can have high confidence if the organization's security researchers have been tracking it for a long time and have gathered a significant amount of intelligence about it through various sources, such as analysis of malware, network traffic, and human intelligence. In contrast, low confidence may indicate the organization has only seen limited or circumstantial evidence." }, "aliases": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "A list of other names that this Threat Actor is believed to use." } }, "required": [ "source", "title", "description", "short_description" ], "example": { "description": "string", "motivation": "Ego", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "identity": { "description": "string", "related_identities": [ { "identity": "string", "confidence": "High", "information_source": "string", "relationship": "string" } ] }, "sophistication": "Aspirant", "schema_version": "1.3.30", "revision": 10, "planning_and_operational_support": "string", "type": "actor", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "intended_effect": "Account Takeover", "language": "string", "id": "string", "tlp": "green", "aliases": [ "string" ], "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "actor_types": [ "Cyber Espionage Operations" ] }, "description": "Schema for submitting new Actors" }, "uniqueItems": true, "example": [ { "description": "string", "motivation": "Ego", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "identity": { "description": "string", "related_identities": [ { "identity": "string", "confidence": "High", "information_source": "string", "relationship": "string" } ] }, "sophistication": "Aspirant", "schema_version": "1.3.30", "revision": 10, "planning_and_operational_support": "string", "type": "actor", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "intended_effect": "Account Takeover", "language": "string", "id": "string", "tlp": "green", "aliases": [ "string" ], "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "actor_types": [ "Cyber Espionage Operations" ] } ], "description": "a list of `NewActor`s." }, "assets": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "asset" ], "example": "asset", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Specifies the time range during which the asset is considered valid or accurate.\nFor example, if an asset entity represents a device, the `valid_time` field could be used to indicate the period during which the device's configuration information is deemed accurate." }, "asset_type": { "type": "string", "enum": [ "application", "data", "device", "network", "person" ], "example": "application", "description": "Type of the Asset: Device, Person, Application, etc." } }, "required": [ "source", "valid_time", "asset_type" ], "example": { "description": "string", "asset_type": "application", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "type": "asset", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z" }, "description": "Schema for submitting new Assets" }, "uniqueItems": true, "example": [ { "description": "string", "asset_type": "application", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "type": "asset", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z" } ], "description": "a list of `NewAsset`s." }, "asset_mappings": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "asset-mapping" ], "example": "asset-mapping", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "For each asset, we allow for the assertion of time bound properties.This gives us both a record of the current state of the asset,as well as history." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "Level of confidence held in the characterization of this AssetMapping e.g.: is it susceptible to manipulation or translation?" }, "specificity": { "type": "string", "enum": [ "Low", "Medium", "Unique" ], "example": "Low", "description": "Denotes the level of how many assets potentially could have this same identifier." }, "stability": { "type": "string", "enum": [ "Managed", "Physical", "Temporary" ], "example": "Managed", "description": "Do we manage when it changes, or is it always a time bound assignment?" }, "observable": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "An AssetMapping is a record that a specific Observable maps to an Asset for an indicated period of time." }, "asset_ref": { "type": "string", "example": "string", "description": "URI that points to the mapped Asset." }, "asset_type": { "type": "string", "enum": [ "application", "data", "device", "network", "person" ], "example": "application", "description": "Type of the mapped Asset: Device, Person, Application, etc." } }, "required": [ "source", "valid_time", "confidence", "specificity", "stability", "observable", "asset_ref", "asset_type" ], "example": { "asset_type": "application", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "stability": "Managed", "schema_version": "1.3.30", "revision": 10, "observable": { "value": "1.2.3.4", "type": "ip" }, "asset_ref": "string", "type": "asset-mapping", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "specificity": "Low", "confidence": "High" }, "description": "Schema for submitting new AssetMapping." }, "uniqueItems": true, "example": [ { "asset_type": "application", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "stability": "Managed", "schema_version": "1.3.30", "revision": 10, "observable": { "value": "1.2.3.4", "type": "ip" }, "asset_ref": "string", "type": "asset-mapping", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "specificity": "Low", "confidence": "High" } ], "description": "a list of `NewAssetMapping`s." }, "asset_properties": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "asset-properties" ], "example": "asset-properties", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "The time range during which the AssetProperties is considered valid." }, "asset_ref": { "type": "string", "example": "string", "description": "URI that points to the associated Asset." }, "properties": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string", "example": "string", "description": "The properties are an open vocabulary." }, "value": { "type": "string", "example": "string" } }, "required": [ "name", "value" ], "example": { "name": "string", "value": "string" } }, "example": [ { "name": "string", "value": "string" } ] } }, "required": [ "source", "valid_time", "asset_ref" ], "example": { "properties": [ { "name": "string", "value": "string" } ], "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "asset_ref": "string", "type": "asset-properties", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z" }, "description": "Schema for submitting new AssetProperties" }, "uniqueItems": true, "example": [ { "properties": [ { "name": "string", "value": "string" } ], "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "asset_ref": "string", "type": "asset-properties", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z" } ], "description": "a list of `NewAssetProperties`s." }, "attack_patterns": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "attack-pattern" ], "example": "attack-pattern", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "kill_chain_phases": { "type": "array", "items": { "type": "object", "properties": { "kill_chain_name": { "type": "string", "example": "string", "description": "The name of the kill chain." }, "phase_name": { "type": "string", "example": "string", "description": "The name of the phase in the kill chain." } }, "required": [ "kill_chain_name", "phase_name" ], "example": { "kill_chain_name": "string", "phase_name": "string" }, "description": "The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives." }, "example": [ { "kill_chain_name": "string", "phase_name": "string" } ], "description": "A kill chain is a series of steps that an attacker must go through to successfully achieve their objective. The concept was originally developed by the military, but has been adapted to the cybersecurity field to describe the steps an attacker goes through to compromise a target system and achieve their goal." }, "x_mitre_data_sources": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "ATT&CK Technique.Data Sources." }, "x_mitre_platforms": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "ATT&CK Technique.Platforms." }, "x_mitre_contributors": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "ATT&CK Technique.Contributors." }, "abstraction_level": { "type": "string", "enum": [ "aggregate", "category", "detailed", "meta", "standard" ], "example": "aggregate", "description": "The CAPEC abstraction level for patterns describing techniques to attack a system." } }, "required": [ "title", "description", "short_description" ], "example": { "description": "string", "abstraction_level": "aggregate", "schema_version": "1.3.30", "revision": 10, "type": "attack-pattern", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "x_mitre_platforms": [ "string" ], "language": "string", "id": "string", "tlp": "green", "x_mitre_data_sources": [ "string" ], "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "x_mitre_contributors": [ "string" ], "timestamp": "2016-01-01T01:01:01Z" }, "description": "For submitting a new AttackPattern" }, "uniqueItems": true, "example": [ { "description": "string", "abstraction_level": "aggregate", "schema_version": "1.3.30", "revision": 10, "type": "attack-pattern", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "x_mitre_platforms": [ "string" ], "language": "string", "id": "string", "tlp": "green", "x_mitre_data_sources": [ "string" ], "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "x_mitre_contributors": [ "string" ], "timestamp": "2016-01-01T01:01:01Z" } ], "description": "a list of `NewAttackPattern`s." }, "campaigns": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "campaign" ], "example": "campaign", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Timestamp for the definition of a specific version of a campaign." }, "campaign_type": { "type": "string", "example": "string", "description": "String value that describes the type of campaign. For example, a campaign type could be 'Ransomware', 'Advanced Persistent Threat', 'Business Email Compromise', 'Phishing', etc. " }, "names": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "Used to capture alternate names or aliases associated with the campaign. A cyberattack campaign may have multiple names or aliases depending on the group or actor(s) behind the attack, e.g., 'Wannacry' is also known as 'WannaCrypt', 'WCry', 'Wanna Decryptor', etc." }, "intended_effect": { "type": "array", "items": { "type": "string", "example": "Account Takeover" }, "example": [ "Account Takeover" ], "description": "Characterizes the intended effect of this cyber threat campaign." }, "status": { "type": "string", "enum": [ "Future", "Historic", "Ongoing" ], "example": "Future", "description": "Indicates current Status of the Campaign. \n\nCan have one of the following values: \n\n- Ongoing: Indicates that the campaign is currently active and ongoing. For example, a mass phishing campaign that is actively targeting users is considered 'ongoing'.\n\n- Historic: Campaign has already occurred and is now in the past.\n\n- Future: This indicates that a campaign is planned or expected to occur in the future. For example, a threat actor may announce their intention to launch a specific cyberattack campaign at a future date." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "Level of confidence held in the characterization of this Campaign." }, "activity": { "type": "array", "items": { "type": "object", "properties": { "date_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Specifies the date and time at which the activity occured." }, "description": { "type": "string", "example": "string", "description": "A description of the activity." } }, "required": [ "date_time", "description" ], "example": { "date_time": "2016-01-01T01:01:01Z", "description": "string" }, "description": "Captures the specific activities or tactics associated with the entity. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc." }, "example": [ { "date_time": "2016-01-01T01:01:01Z", "description": "string" } ], "description": "Used to capture specific activities or tactics associated with the campaign.\nThe 'activity' field is an array of objects, and each element represents a specific activity and time associated with the campaign. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc. By capturing these activities analysts can identify the specific tactics used by the threat actor(s) behind the campaign." } }, "required": [ "title", "description", "short_description", "campaign_type" ], "example": { "description": "string", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "type": "campaign", "campaign_type": "string", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "activity": [ { "date_time": "2016-01-01T01:01:01Z", "description": "string" } ], "source_uri": "string", "intended_effect": [ "Account Takeover" ], "status": "Future", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "names": [ "string" ] }, "description": "Schema for submitting new Campaigns" }, "uniqueItems": true, "example": [ { "description": "string", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "type": "campaign", "campaign_type": "string", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "activity": [ { "date_time": "2016-01-01T01:01:01Z", "description": "string" } ], "source_uri": "string", "intended_effect": [ "Account Takeover" ], "status": "Future", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "names": [ "string" ] } ], "description": "a list of `NewCampaign`s." }, "coas": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "coa" ], "example": "coa", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid." }, "stage": { "type": "string", "enum": [ "Containment", "Eradication", "Identification", "Lessons Learned", "Preparation", "Recovery", "Remedy", "Response" ], "example": "Containment", "description": "Specifies what stage in the cyber threat management lifecycle this Course Of Action is relevant to." }, "coa_type": { "type": "string", "enum": [ "Diplomatic Actions", "Eradication", "Hardening", "Internal Blocking", "Logical Access Restrictions", "Monitoring", "Other", "Patching", "Perimeter Blocking", "Phase", "Physical Access Restrictions", "Playbook", "Policy Actions", "Public Disclosure", "Rebuilding", "Redirection", "Redirection (Honey Pot)", "Task", "Training" ], "example": "Diplomatic Actions", "description": "The type of this COA" }, "objective": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "Characterizes the objective to provide guidance on how to mitigate a security incident that has been identified." }, "impact": { "type": "string", "example": "string", "description": "Characterizes the estimated impact of applying this course of action." }, "cost": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "Characterizes the estimated cost for applying this course of action." }, "efficacy": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "Effectiveness of this course of action in achieving its targeted objective." }, "related_COAs": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "source": { "type": "string", "example": "string" }, "relationship": { "type": "string", "example": "string" }, "COA_id": { "type": "string", "example": "string", "description": "A URI leading to a COA." } }, "required": [ "COA_id" ], "example": { "confidence": "High", "source": "string", "relationship": "string", "COA_id": "string" } }, "example": [ { "confidence": "High", "source": "string", "relationship": "string", "COA_id": "string" } ], "description": "Identifies or characterizes relationships to one or more related courses of action." }, "structured_coa_type": { "type": "string", "enum": [ "openc2" ], "example": "openc2" }, "open_c2_coa": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "structured_coa" ], "example": "structured_coa" }, "id": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "action": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "alert", "allow", "augment", "contain", "delete", "deny", "detonate", "distill", "get", "investigate", "locate", "mitigate", "modify", "move", "notify", "other", "pause", "query", "redirect", "remediate", "report", "response", "restart", "restore", "resume", "save", "scan", "set", "snapshot", "start", "stop", "substitute", "sync", "throttle", "update" ], "example": "alert" } }, "required": [ "type" ], "example": { "type": "alert" } }, "target": { "type": "object", "properties": { "type": { "type": "string", "example": "acudid" }, "specifiers": { "type": "string", "example": "string", "description": "Observable types that can be acted upon." } }, "required": [ "type" ], "example": { "type": "acudid", "specifiers": "string" } }, "actuator": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "endpoint", "endpoint.digital-telephone-handset", "endpoint.laptop", "endpoint.pos-terminal", "endpoint.printer", "endpoint.sensor", "endpoint.server", "endpoint.smart-meter", "endpoint.smart-phone", "endpoint.tablet", "endpoint.workstation", "network", "network.bridge", "network.firewall", "network.gateway", "network.guard", "network.hips", "network.hub", "network.ids", "network.ips", "network.modem", "network.nic", "network.proxy", "network.router", "network.security_manager", "network.sense_making", "network.sensor", "network.switch", "network.vpn", "network.wap", "other", "process", "process.aaa-server", "process.anti-virus-scanner", "process.connection-scanner", "process.directory-service", "process.dns-server", "process.email-service", "process.file-scanner", "process.location-service", "process.network-scanner", "process.remediation-service", "process.reputation-service", "process.sandbox", "process.virtualization-service", "process.vulnerability-scanner" ], "example": "endpoint" }, "specifiers": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "List of additional properties describing the actuator." } }, "required": [ "type" ], "example": { "type": "endpoint", "specifiers": [ "string" ] } }, "modifiers": { "type": "object", "properties": { "delay": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard." }, "duration": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard." }, "frequency": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "id": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid." }, "response": { "type": "string", "enum": [ "acknowledge", "command-ref", "query", "status" ], "example": "acknowledge" }, "source": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "destination": { "type": "string", "enum": [ "copy-to", "modify-to", "move-to", "report-to", "restore-point", "save-to", "set-to" ], "example": "copy-to" }, "method": { "type": "array", "items": { "type": "string", "enum": [ "acl", "authenticated", "blackhole", "blacklist", "graceful", "hibernate", "honeypot", "immediate", "segmentation", "spawn", "suspend", "unauthenticated", "whitelist" ], "example": "acl" }, "example": [ "acl" ] }, "search": { "type": "string", "enum": [ "cve", "patch", "signature", "vendor_bulletin" ], "example": "cve" }, "location": { "type": "string", "enum": [ "internal", "perimeter" ], "example": "internal" }, "option": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "additional_properties": { "type": "object", "properties": { "context": { "type": "string", "example": "string", "description": "String with at most 1024 characters." } }, "required": [ "context" ], "example": { "context": "string" } } }, "example": { "response": "acknowledge", "method": [ "acl" ], "additional_properties": { "context": "string" }, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "frequency": "string", "duration": "2016-01-01T01:01:01Z", "source": "string", "search": "cve", "option": "string", "id": "string", "location": "internal", "delay": "2016-01-01T01:01:01Z", "destination": "copy-to" } } }, "required": [ "type", "action" ], "example": { "type": "structured_coa", "id": "string", "action": { "type": "alert" }, "target": { "type": "acudid", "specifiers": "string" }, "actuator": { "type": "endpoint", "specifiers": [ "string" ] }, "modifiers": { "response": "acknowledge", "method": [ "acl" ], "additional_properties": { "context": "string" }, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "frequency": "string", "duration": "2016-01-01T01:01:01Z", "source": "string", "search": "cve", "option": "string", "id": "string", "location": "internal", "delay": "2016-01-01T01:01:01Z", "destination": "copy-to" } } } }, "example": { "description": "string", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "stage": "Containment", "schema_version": "1.3.30", "revision": 10, "efficacy": "High", "type": "coa", "related_COAs": [ { "confidence": "High", "source": "string", "relationship": "string", "COA_id": "string" } ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "coa_type": "Diplomatic Actions", "language": "string", "id": "string", "tlp": "green", "objective": [ "string" ], "cost": "High", "timestamp": "2016-01-01T01:01:01Z", "open_c2_coa": { "type": "structured_coa", "id": "string", "action": { "type": "alert" }, "target": { "type": "acudid", "specifiers": "string" }, "actuator": { "type": "endpoint", "specifiers": [ "string" ] }, "modifiers": { "response": "acknowledge", "method": [ "acl" ], "additional_properties": { "context": "string" }, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "frequency": "string", "duration": "2016-01-01T01:01:01Z", "source": "string", "search": "cve", "option": "string", "id": "string", "location": "internal", "delay": "2016-01-01T01:01:01Z", "destination": "copy-to" } }, "structured_coa_type": "openc2", "impact": "string" }, "description": "Schema for submitting new COAs" }, "uniqueItems": true, "example": [ { "description": "string", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "stage": "Containment", "schema_version": "1.3.30", "revision": 10, "efficacy": "High", "type": "coa", "related_COAs": [ { "confidence": "High", "source": "string", "relationship": "string", "COA_id": "string" } ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "coa_type": "Diplomatic Actions", "language": "string", "id": "string", "tlp": "green", "objective": [ "string" ], "cost": "High", "timestamp": "2016-01-01T01:01:01Z", "open_c2_coa": { "type": "structured_coa", "id": "string", "action": { "type": "alert" }, "target": { "type": "acudid", "specifiers": "string" }, "actuator": { "type": "endpoint", "specifiers": [ "string" ] }, "modifiers": { "response": "acknowledge", "method": [ "acl" ], "additional_properties": { "context": "string" }, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "frequency": "string", "duration": "2016-01-01T01:01:01Z", "source": "string", "search": "cve", "option": "string", "id": "string", "location": "internal", "delay": "2016-01-01T01:01:01Z", "destination": "copy-to" } }, "structured_coa_type": "openc2", "impact": "string" } ], "description": "a list of `NewCOA`s." }, "feedbacks": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "feedback" ], "example": "feedback", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "entity_id": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "feedback": { "type": "integer", "enum": [ -1, 0, 1 ], "example": -1 }, "reason": { "type": "string", "example": "string" } }, "required": [ "entity_id", "feedback", "reason" ], "example": { "feedback": -1, "schema_version": "1.3.30", "revision": 10, "type": "feedback", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "reason": "string", "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "entity_id": "string", "timestamp": "2016-01-01T01:01:01Z" }, "description": "Schema for submitting new Feedback." }, "uniqueItems": true, "example": [ { "feedback": -1, "schema_version": "1.3.30", "revision": 10, "type": "feedback", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "reason": "string", "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "entity_id": "string", "timestamp": "2016-01-01T01:01:01Z" } ], "description": "a list of `NewFeedback`s." }, "incidents": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "incident" ], "example": "incident", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "Represents the level of certainty or trustworthiness associated with the incident. It denotes the reliability of the intelligence associated with the incident.\nThe `confidence` field can take on several values, including:\n- `info`: Indicates that the incident information is based on sources with no previous track record or there is no track record for the source reporting the incident.\n- `low`: Indicates that the incident information is based on sources with a questionable track record or there is limited information about the accuracy of the source.\n- `medium`: Indicates that the incident information is based on sources with a mixed track record or of uncertain reliability.\n- `high`: Indicates that the incident information is based on sources with a proven track record and high degree of reliability.\nThe `confidence` field can be used to indicate the level of trust and confidence that can be attributed to the incident, and it may impact how the incident is prioritized, analyzed and addressed. It can also help in the decision-making process associated with the incident response activities.\nIt is important to note that the `confidence` field is subjective and can be interpreted differently by different organizations or analysts. As such, it is often used in conjunction with other intelligence attributes, such as the `severity` field, to provide a more complete picture of the incident." }, "status": { "type": "string", "enum": [ "Closed", "Closed: Confirmed Threat", "Closed: False Positive", "Closed: Merged", "Closed: Near-Miss", "Closed: Other", "Closed: Suspected", "Closed: Under Review", "Containment Achieved", "Hold", "Hold: External", "Hold: Internal", "Hold: Legal", "Incident Reported", "New", "New: Presented", "New: Processing", "Open", "Open: Contained", "Open: Investigating", "Open: Recovered", "Open: Reported", "Rejected", "Restoration Achieved", "Stalled" ], "example": "Closed", "description": "The `status` field represents the current state of an incident within the incident management process. Its values help in tracking and reporting the progress of the incident from its discovery to its resolution." }, "incident_time": { "type": "object", "properties": { "opened": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time the incident was first opened." }, "discovered": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time the incident was first discovered." }, "reported": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time the incident was first reported." }, "remediated": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time that the remediation of the damage from the incident was completed." }, "closed": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time that the incident was last closed." }, "rejected": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time that the incident was first rejected." }, "contained": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time that the incident was first contained." } }, "required": [ "opened" ], "example": { "opened": "2016-01-01T01:01:01Z", "discovered": "2016-01-01T01:01:01Z", "reported": "2016-01-01T01:01:01Z", "remediated": "2016-01-01T01:01:01Z", "closed": "2016-01-01T01:01:01Z", "rejected": "2016-01-01T01:01:01Z", "contained": "2016-01-01T01:01:01Z" }, "description": "Relevant time values associated with this Incident." }, "meta": { "type": "object", "additionalProperties": { "type": "string", "example": "string", "x-anyOf": [ { "type": "string", "example": "string" }, { "type": "number", "format": "double", "example": 10.0 }, { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z" }, { "type": "string", "example": "keyword" }, { "type": "boolean", "example": true } ] }, "example": { "keyword": "string" }, "description": "metadata associated to the incident.", "properties": {} }, "scores": { "type": "object", "additionalProperties": { "type": "number", "format": "double", "example": 10.0, "description": "A non-negative score number." }, "example": { "asset": 10.0 }, "description": "Used to indicate the severity or impact score of the threat represented by the incident.", "properties": {} }, "categories": { "type": "array", "items": { "type": "string", "example": "Attrition" }, "example": [ "Attrition" ], "description": "A set of categories for this incident." }, "discovery_method": { "type": "string", "example": "Agent Disclosure", "description": "Identifies how the incident was discovered." }, "intended_effect": { "type": "string", "example": "Account Takeover", "description": "Specifies the suspected intended effect of this incident" }, "assignees": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "A set of owners assigned to this incident." }, "detection_sources": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "example": [ "string" ], "description": "A set of sources that contributed threat detections to the incident." }, "promotion_method": { "type": "string", "enum": [ "Automated", "Manual" ], "example": "Automated", "description": "Describes method for promoting an Incident, whether manually or automatically. An Incident may be created manually by a SOAR analyst or SOC operator, or through an automated correlation or aggregation rule or engine that matches a specific set of events or alerts, and promotes them to Incident(s)." }, "detection_status": { "type": "string", "enum": [ "active", "inactive_expired", "inactive_merged", "inactive_oversized", "inactive_user_closed" ], "example": "active", "description": "Represents the state of an incident within the incident generation process, indicating whether the incident is actively receiving updates or is no longer being updated." }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "Critical", "description": "Represents the potential impact of an incident on an organization's security posture and business operations. It helps organizations prioritize and allocate resources for incident response based on the severity level of the incident \nIt helps analysts and incident handlers prioritize incidents by indicating the level of risk and potential impact associated with the incident. This enables organizations to allocate resources efficiently and address the most critical incidents first.\nCan also be used to generate reports and metrics for measuring the effectiveness of the incident response process and to identify trends and patterns in the threat landscape.\nIt is important to note that the `severity` field is subjective and can be interpreted differently by different organizations or analysts. Therefore, it should be used in conjunction with other intelligence attributes, such as the `confidence` field, to provide a more comprehensive view of the incident." }, "tactics": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "Represents the offensive techniques, approaches, or procedures that an adversary may use to achieve their objectives during an attack. It helps in understanding the intent and capabilities of the adversary and can be used to identify indicators of attack (IoAs) or indicators of compromise (IoCs) that are associated with the adversary's tactics." }, "techniques": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "Represents the specific methods or actions used by an attacker to carry out an offensive maneuver or achieve their goals." }, "short_id": { "type": "string", "example": "string", "description": "A human-readable, short identifier for the incident, unique within an organization." } }, "required": [ "confidence", "status", "incident_time" ], "example": { "description": "string", "assignees": [ "string" ], "detection_sources": [ "string" ], "meta": { "keyword": "string" }, "schema_version": "1.3.30", "revision": 10, "type": "incident", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "incident_time": { "opened": "2016-01-01T01:01:01Z", "discovered": "2016-01-01T01:01:01Z", "reported": "2016-01-01T01:01:01Z", "remediated": "2016-01-01T01:01:01Z", "closed": "2016-01-01T01:01:01Z", "rejected": "2016-01-01T01:01:01Z", "contained": "2016-01-01T01:01:01Z" }, "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "discovery_method": "Agent Disclosure", "source_uri": "string", "intended_effect": "Account Takeover", "categories": [ "Attrition" ], "status": "Closed", "language": "string", "detection_status": "active", "id": "string", "promotion_method": "Automated", "severity": "Critical", "tlp": "green", "scores": { "asset": 10.0 }, "techniques": [ "string" ], "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "short_id": "string", "tactics": [ "string" ] }, "description": "For submitting a new Incident." }, "uniqueItems": true, "example": [ { "description": "string", "assignees": [ "string" ], "detection_sources": [ "string" ], "meta": { "keyword": "string" }, "schema_version": "1.3.30", "revision": 10, "type": "incident", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "incident_time": { "opened": "2016-01-01T01:01:01Z", "discovered": "2016-01-01T01:01:01Z", "reported": "2016-01-01T01:01:01Z", "remediated": "2016-01-01T01:01:01Z", "closed": "2016-01-01T01:01:01Z", "rejected": "2016-01-01T01:01:01Z", "contained": "2016-01-01T01:01:01Z" }, "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "discovery_method": "Agent Disclosure", "source_uri": "string", "intended_effect": "Account Takeover", "categories": [ "Attrition" ], "status": "Closed", "language": "string", "detection_status": "active", "id": "string", "promotion_method": "Automated", "severity": "Critical", "tlp": "green", "scores": { "asset": 10.0 }, "techniques": [ "string" ], "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "short_id": "string", "tactics": [ "string" ] } ], "description": "a list of `NewIncident`s." }, "indicators": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "indicator" ], "example": "indicator", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "The time range during which this Indicator is considered valid." }, "producer": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "Critical" }, "negate": { "type": "boolean", "example": true, "description": "Specifies the absence of the pattern." }, "indicator_type": { "type": "array", "items": { "type": "string", "enum": [ "Anonymization", "C2", "Compromised PKI Certificate", "Domain Watchlist", "Exfiltration", "File Hash Watchlist", "Host Characteristics", "IMEI Watchlist", "IMSI Watchlist", "IP Watchlist", "Login Name", "Malicious E-mail", "Malware Artifacts", "Private Threat Feed", "URL Watchlist" ], "example": "Anonymization" }, "example": [ "Anonymization" ], "description": "Specifies the type or types for this Indicator." }, "tags": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "Descriptors for this indicator." }, "composite_indicator_expression": { "type": "object", "properties": { "operator": { "type": "string", "enum": [ "and", "not", "or" ], "example": "and" }, "indicator_ids": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an indicator." }, "example": [ "string" ] } }, "required": [ "operator", "indicator_ids" ], "example": { "operator": "and", "indicator_ids": [ "string" ] } }, "likely_impact": { "type": "string", "example": "string", "description": "Likely potential impact within the relevant context if this Indicator were to occur." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "level of confidence held in the accuracy of this Indicator." }, "kill_chain_phases": { "type": "array", "items": { "type": "object", "properties": { "kill_chain_name": { "type": "string", "example": "string", "description": "The name of the kill chain." }, "phase_name": { "type": "string", "example": "string", "description": "The name of the phase in the kill chain." } }, "required": [ "kill_chain_name", "phase_name" ], "example": { "kill_chain_name": "string", "phase_name": "string" }, "description": "The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives." }, "example": [ { "kill_chain_name": "string", "phase_name": "string" } ], "description": "Relevant kill chain phases indicated by this Indicator." }, "test_mechanisms": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "example": [ "string" ], "description": "Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator." }, "specification": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Judgement" ], "example": "Judgement" }, "judgements": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to a judgement." }, "example": [ "string" ] }, "required_judgements": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "source": { "type": "string", "example": "string" }, "relationship": { "type": "string", "example": "string" }, "judgement_id": { "type": "string", "example": "string", "description": "A URI leading to a judgement." } }, "required": [ "judgement_id" ], "example": { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } }, "example": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "required": [ "type", "judgements", "required_judgements" ], "example": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] }, "description": "An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.", "x-anyOf": [ { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Judgement" ], "example": "Judgement" }, "judgements": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to a judgement." }, "example": [ "string" ] }, "required_judgements": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "source": { "type": "string", "example": "string" }, "relationship": { "type": "string", "example": "string" }, "judgement_id": { "type": "string", "example": "string", "description": "A URI leading to a judgement." } }, "required": [ "judgement_id" ], "example": { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } }, "example": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "required": [ "type", "judgements", "required_judgements" ], "example": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] }, "description": "An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "ThreatBrain" ], "example": "ThreatBrain" }, "query": { "type": "string", "example": "string" }, "variables": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ] } }, "required": [ "type", "variables" ], "example": { "type": "ThreatBrain", "query": "string", "variables": [ "string" ] }, "description": "An indicator which runs in threatbrain..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Snort" ], "example": "Snort" }, "snort_sig": { "type": "string", "example": "string" } }, "required": [ "type", "snort_sig" ], "example": { "type": "Snort", "snort_sig": "string" }, "description": "An indicator which runs in snort..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "SIOC" ], "example": "SIOC" }, "SIOC": { "type": "string", "example": "string" } }, "required": [ "type", "SIOC" ], "example": { "type": "SIOC", "SIOC": "string" }, "description": "An indicator which runs in snort..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "OpenIOC" ], "example": "OpenIOC" }, "open_IOC": { "type": "string", "example": "string" } }, "required": [ "type", "open_IOC" ], "example": { "type": "OpenIOC", "open_IOC": "string" }, "description": "An indicator which contains an XML blob of an openIOC indicator." } ] } }, "required": [ "producer" ], "example": { "description": "string", "tags": [ "string" ], "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "producer": "string", "schema_version": "1.3.30", "revision": 10, "type": "indicator", "test_mechanisms": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "composite_indicator_expression": { "operator": "and", "indicator_ids": [ "string" ] }, "title": "string", "likely_impact": "string", "indicator_type": [ "Anonymization" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "severity": "Critical", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "negate": true, "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "specification": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "description": "For submitting a new Indicator" }, "uniqueItems": true, "example": [ { "description": "string", "tags": [ "string" ], "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "producer": "string", "schema_version": "1.3.30", "revision": 10, "type": "indicator", "test_mechanisms": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "composite_indicator_expression": { "operator": "and", "indicator_ids": [ "string" ] }, "title": "string", "likely_impact": "string", "indicator_type": [ "Anonymization" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "severity": "Critical", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "negate": true, "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "specification": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } } ], "description": "a list of `NewIndicator`s." }, "judgements": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "judgement" ], "example": "judgement", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "observable": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." }, "disposition": { "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Matches :disposition_name as in {1 \"Clean\", 2 \"Malicious\", 3 \"Suspicious\", 4 \"Common\", 5 \"Unknown\"}" }, "disposition_name": { "type": "string", "enum": [ "Clean", "Common", "Malicious", "Suspicious", "Unknown" ], "example": "Clean", "description": "String verdict identifiers." }, "priority": { "type": "integer", "format": "int64", "example": 10, "description": "A value 0-100 that determine the priority of a judgement. Curated feeds of black/white lists, for example known good products within your organizations, should use a 95. All automated systems should use a priority of 90, or less. Human judgements should have a priority of 100, so that humans can always override machines." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "Critical" }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid." }, "reason": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "reason_uri": { "type": "string", "example": "string", "description": "A URI" } }, "required": [ "source", "observable", "priority", "confidence", "severity" ], "example": { "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "observable": { "value": "1.2.3.4", "type": "ip" }, "reason_uri": "string", "type": "judgement", "source": "string", "external_ids": [ "string" ], "disposition": 1, "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "reason": "string", "source_uri": "string", "disposition_name": "Clean", "priority": 10, "language": "string", "id": "string", "severity": "Critical", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "confidence": "High" }, "description": "Schema for submitting new Judgements." }, "uniqueItems": true, "example": [ { "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "observable": { "value": "1.2.3.4", "type": "ip" }, "reason_uri": "string", "type": "judgement", "source": "string", "external_ids": [ "string" ], "disposition": 1, "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "reason": "string", "source_uri": "string", "disposition_name": "Clean", "priority": 10, "language": "string", "id": "string", "severity": "Critical", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "confidence": "High" } ], "description": "a list of `NewJudgement`s." }, "malwares": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "malware" ], "example": "malware", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "labels": { "type": "array", "items": { "type": "string", "example": "adware", "description": "Malware label is an open vocabulary that represents different types and functions of malware. Malware labels are not mutually exclusive; a malware instance can be both spyware and a screen capture tool." }, "example": [ "adware" ], "description": "The type of malware being described." }, "kill_chain_phases": { "type": "array", "items": { "type": "object", "properties": { "kill_chain_name": { "type": "string", "example": "string", "description": "The name of the kill chain." }, "phase_name": { "type": "string", "example": "string", "description": "The name of the phase in the kill chain." } }, "required": [ "kill_chain_name", "phase_name" ], "example": { "kill_chain_name": "string", "phase_name": "string" }, "description": "The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives." }, "example": [ { "kill_chain_name": "string", "phase_name": "string" } ], "description": "The list of Kill Chain Phases for which this Malware can be used." }, "x_mitre_aliases": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "ATT&CK Software.aliases." }, "abstraction_level": { "type": "string", "enum": [ "family", "variant", "version" ], "example": "family", "description": "Malware abstraction level." } }, "required": [ "title", "description", "short_description", "labels" ], "example": { "description": "string", "labels": [ "adware" ], "abstraction_level": "family", "schema_version": "1.3.30", "revision": 10, "type": "malware", "x_mitre_aliases": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "timestamp": "2016-01-01T01:01:01Z" }, "description": "For submitting a new Malware." }, "uniqueItems": true, "example": [ { "description": "string", "labels": [ "adware" ], "abstraction_level": "family", "schema_version": "1.3.30", "revision": 10, "type": "malware", "x_mitre_aliases": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "timestamp": "2016-01-01T01:01:01Z" } ], "description": "a list of `NewMalware`s." }, "notes": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "note" ], "example": "note", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "note_class": { "type": "string", "example": "keyword" }, "content": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "related_entities": { "type": "array", "items": { "type": "object", "properties": { "entity_type": { "type": "string", "example": "string" }, "entity_id": { "type": "string", "example": "string", "description": "A URI leading to an entity." } }, "required": [ "entity_type", "entity_id" ], "example": { "entity_type": "string", "entity_id": "string" } }, "example": [ { "entity_type": "string", "entity_id": "string" } ] }, "author": { "type": "string", "example": "string" } }, "required": [ "note_class", "content", "related_entities" ], "example": { "schema_version": "1.3.30", "revision": 10, "content": "string", "note_class": "keyword", "type": "note", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "author": "string", "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "related_entities": [ { "entity_type": "string", "entity_id": "string" } ] }, "description": "Schema for submitting Notes" }, "uniqueItems": true, "example": [ { "schema_version": "1.3.30", "revision": 10, "content": "string", "note_class": "keyword", "type": "note", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "author": "string", "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "related_entities": [ { "entity_type": "string", "entity_id": "string" } ] } ], "description": "a list of `NewNote`s." }, "relationships": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "relationship" ], "example": "relationship", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "relationship_type": { "type": "string", "example": "attributed-to" }, "source_ref": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "target_ref": { "type": "string", "example": "string", "description": "A URI leading to an entity." } }, "required": [ "relationship_type", "source_ref", "target_ref" ], "example": { "description": "string", "schema_version": "1.3.30", "revision": 10, "target_ref": "string", "type": "relationship", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "source_ref": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "relationship_type": "attributed-to" }, "description": "Schema for submitting new Relationships." }, "uniqueItems": true, "example": [ { "description": "string", "schema_version": "1.3.30", "revision": 10, "target_ref": "string", "type": "relationship", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "source_ref": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "relationship_type": "attributed-to" } ], "description": "a list of `NewRelationship`s." }, "sightings": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "sighting" ], "example": "sighting", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "observed_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "count": { "type": "integer", "format": "int64", "example": 10, "description": "The number of times an indicator was observed within a certain period of time.\nFor example, if an IP address associated with known malicious activity is observed once within a period of time, it may indicate a low-level threat. However, if the same IP address is observed multiple times within a short time frame, it may indicate a more severe and persistent threat.\nIt can also be used to prioritize security alerts and indicate the urgency of a response. High counts indicate that an indicator is actively being used in a larger campaign, while low counts may indicate isolated incidents." }, "internal": { "type": "boolean", "example": false, "description": "If `true`, indicates that the sighting was reported from internal sources, such as an organization's own internal security tools or SOC.\n Internal sightings are often considered more reliable and actionable than external sightings, which are reported from external sources and may have a lower level of trustworthiness. Internal sightings can provide more context and can help identify potential threats that are unique to a particular environment or organization.\n Internal sightings can also help organizations prioritize their security response efforts by identifying threats that are specific to their environment and may not yet be widely known." }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "Critical" }, "resolution": { "type": "string", "example": "detected", "description": "Represents the disposition or actions taken on the associated threat intelligence." }, "data": { "type": "object", "properties": { "columns": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string", "example": "string" }, "type": { "type": "string", "enum": [ "integer", "markdown", "number", "observable", "string", "url" ], "example": "integer" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "required": { "type": "boolean", "example": true, "description": "If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`." }, "short_description": { "type": "string", "example": "string" } }, "required": [ "name", "type" ], "example": { "name": "string", "type": "integer", "description": "string", "required": true, "short_description": "string" } }, "example": [ { "name": "string", "type": "integer", "description": "string", "required": true, "short_description": "string" } ], "description": "an ordered list of column definitions" }, "rows": { "type": "array", "items": { "type": "array", "items": { "example": "anything" } }, "example": [ [ "anything" ] ], "description": "an ordered list of rows" }, "row_count": { "type": "integer", "format": "int64", "example": 10, "description": "The number of rows in the data table." } }, "required": [ "columns", "rows" ], "example": { "columns": [ { "name": "string", "type": "integer", "description": "string", "required": true, "short_description": "string" } ], "rows": [ [ "anything" ] ], "row_count": 10 }, "description": "An embedded data table for the Sighting." }, "sensor": { "type": "string", "example": "endpoint", "description": "The OpenC2 Actuator name that best fits the device that is creating this sighting (e.g. network.firewall)" }, "sensor_coordinates": { "type": "object", "properties": { "type": { "type": "string", "example": "endpoint", "description": "The sensor/actuator name that best fits a device." }, "observables": { "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." }, "example": [ { "value": "1.2.3.4", "type": "ip" } ] }, "os": { "type": "string", "example": "string" } }, "required": [ "type", "observables" ], "example": { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "os": "string" }, "description": "Describes the device that made the sighting (sensor) and contains identifying observables for the sensor." }, "targets": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "endpoint", "description": "The sensor/actuator name that best fits a device." }, "observables": { "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." }, "example": [ { "value": "1.2.3.4", "type": "ip" } ] }, "observed_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "os": { "type": "string", "example": "string" } }, "required": [ "type", "observables", "observed_time" ], "example": { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "os": "string" }, "description": "Describes the target of the sighting and contains identifying observables for the target." }, "example": [ { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "os": "string" } ], "description": "May include one or more targets that observed the associated indicator. Targets can include network devices, host devices, or other entities that are capable of detecting indicators of compromise.\n\nCan be used to assess the scope of potential threats, helping analysts understand which devices or components of the network may be vulnerable to attack. For example, if a particular malware strain is detected on several different systems within an organization, the `targets` field may indicate which systems are affected and which may need to be isolated or patched to prevent further spread." }, "observables": { "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." }, "example": [ { "value": "1.2.3.4", "type": "ip" } ], "description": "The object(s) of interest." }, "relations": { "type": "array", "items": { "type": "object", "properties": { "origin": { "type": "string", "example": "string" }, "origin_uri": { "type": "string", "example": "string", "description": "A URI" }, "relation": { "type": "string", "example": "Allocated" }, "relation_info": { "type": "object", "additionalProperties": { "example": "anything" }, "example": { "keyword": "anything" }, "properties": {} }, "source": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." }, "related": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." } }, "required": [ "origin", "relation", "source", "related" ], "example": { "origin": "string", "origin_uri": "string", "relation": "Allocated", "relation_info": { "keyword": "anything" }, "source": { "value": "1.2.3.4", "type": "ip" }, "related": { "value": "1.2.3.4", "type": "ip" } }, "description": "A relation inside a Sighting." }, "example": [ { "origin": "string", "origin_uri": "string", "relation": "Allocated", "relation_info": { "keyword": "anything" }, "source": { "value": "1.2.3.4", "type": "ip" }, "related": { "value": "1.2.3.4", "type": "ip" } } ], "description": "Provide any context we can about where the observable came from." }, "context": { "type": "object", "properties": { "process_create_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "type": { "type": "string", "enum": [ "ProcessCreateEvent" ], "example": "ProcessCreateEvent" }, "process_args": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "process_hash": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "process_size": { "type": "integer", "format": "int64", "example": 10 }, "process_disposition": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "parent_creation_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard." }, "parent_process_id": { "type": "integer", "format": "int64", "example": 10 }, "parent_process_guid": { "type": "integer", "format": "int64", "example": 10 }, "parent_process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "parent_process_args": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "parent_process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "parent_process_hash": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "parent_process_size": { "type": "integer", "format": "int64", "example": 10 }, "parent_process_disposition": { "type": "string", "example": "string", "description": "String with at most 1024 characters." } }, "required": [ "time", "process_id", "process_name", "type" ], "example": { "parent_process_name": "string", "process_guid": 10, "parent_process_guid": 10, "process_disposition": "string", "parent_process_size": 10, "process_size": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_disposition": "string", "type": "ProcessCreateEvent", "parent_process_username": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "parent_creation_time": "2016-01-01T01:01:01Z", "process_args": "string" } }, "example": [ { "parent_process_name": "string", "process_guid": 10, "parent_process_guid": 10, "process_disposition": "string", "parent_process_size": 10, "process_size": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_disposition": "string", "type": "ProcessCreateEvent", "parent_process_username": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "parent_creation_time": "2016-01-01T01:01:01Z", "process_args": "string" } ], "description": "a list of `ProcessCreate`" }, "library_load_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "type": { "type": "string", "enum": [ "LibraryLoadEvent" ], "example": "LibraryLoadEvent" }, "dll_library_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "dll_library_path": { "type": "string", "example": "string", "description": "String with at most 2048 characters." } }, "required": [ "time", "process_id", "process_name", "type", "dll_library_name", "dll_library_path" ], "example": { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "type": "LibraryLoadEvent", "dll_library_name": "string", "dll_library_path": "string" } }, "example": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "type": "LibraryLoadEvent", "dll_library_name": "string", "dll_library_path": "string" } ], "description": "a list of `LibraryLoadType`" }, "file_create_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "file_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "file_path": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "type": { "type": "string", "enum": [ "FileCreateEvent" ], "example": "FileCreateEvent" }, "failed": { "type": "boolean", "example": false } }, "required": [ "time", "process_id", "process_name", "file_name", "file_path", "type" ], "example": { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileCreateEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } }, "example": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileCreateEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "description": "a list of `FileCreateType`" }, "file_delete_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "file_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "file_path": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "type": { "type": "string", "enum": [ "FileDeleteEvent" ], "example": "FileDeleteEvent" }, "failed": { "type": "boolean", "example": false } }, "required": [ "time", "process_id", "process_name", "file_name", "file_path", "type" ], "example": { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileDeleteEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } }, "example": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileDeleteEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "description": "a list of `FileDeleteType`" }, "file_modify_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "file_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "file_path": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "type": { "type": "string", "enum": [ "FileModifyEvent" ], "example": "FileModifyEvent" }, "failed": { "type": "boolean", "example": false } }, "required": [ "time", "process_id", "process_name", "file_name", "file_path", "type" ], "example": { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileModifyEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } }, "example": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileModifyEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "description": "a list of `FileModifyType`" }, "file_move_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "file_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "file_path": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "type": { "type": "string", "enum": [ "FileMoveEvent" ], "example": "FileMoveEvent" }, "old_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "new_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." } }, "required": [ "time", "process_id", "process_name", "file_name", "file_path", "type", "old_name", "new_name" ], "example": { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileMoveEvent", "old_name": "string", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "new_name": "string" } }, "example": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileMoveEvent", "old_name": "string", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "new_name": "string" } ], "description": "a list of `FileMoveType`" }, "netflow_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "type": { "type": "string", "enum": [ "NetflowEvent" ], "example": "NetflowEvent" }, "traffic": { "type": "object", "properties": { "protocol": { "type": "integer", "format": "int64", "example": 10, "description": "The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)" }, "source_ip": { "type": "string", "example": "string" }, "destination_ip": { "type": "string", "example": "string" }, "source_port": { "type": "integer", "format": "int64", "example": 10 }, "destination_port": { "type": "integer", "format": "int64", "example": 10 }, "direction": { "type": "string", "enum": [ "incoming", "outgoing" ], "example": "incoming" }, "destination_host_name": { "type": "string", "example": "string" }, "source_subnet": { "type": "string", "example": "string" }, "destination_subnet": { "type": "string", "example": "string" } }, "required": [ "protocol", "source_ip", "destination_ip", "source_port", "destination_port", "direction" ], "example": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 } }, "process_path": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_args": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_hash": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_account_type": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_account": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "parent_process_id": { "type": "integer", "format": "int64", "example": 10 }, "parent_process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "parent_process_path": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "parent_process_args": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "parent_process_hash": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "parent_process_account": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "parent_process_account_type": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "flow_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard." }, "byte_count_out": { "type": "integer", "format": "int64", "example": 10 }, "byte_count_in": { "type": "integer", "format": "int64", "example": 10 } }, "required": [ "time", "process_id", "process_name", "type", "traffic" ], "example": { "parent_process_name": "string", "byte_count_in": 10, "process_guid": 10, "process_path": "string", "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "flow_time": "2016-01-01T01:01:01Z", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_account": "string", "type": "NetflowEvent", "process_account_type": "string", "parent_process_path": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_account": "string", "parent_process_account_type": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "byte_count_out": 10, "process_args": "string" } }, "example": [ { "parent_process_name": "string", "byte_count_in": 10, "process_guid": 10, "process_path": "string", "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "flow_time": "2016-01-01T01:01:01Z", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_account": "string", "type": "NetflowEvent", "process_account_type": "string", "parent_process_path": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_account": "string", "parent_process_account_type": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "byte_count_out": 10, "process_args": "string" } ], "description": "a list of `NetflowType`" }, "http_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "type": { "type": "string", "enum": [ "HTTPEvent" ], "example": "HTTPEvent" }, "host": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "traffic": { "type": "object", "properties": { "protocol": { "type": "integer", "format": "int64", "example": 10, "description": "The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)" }, "source_ip": { "type": "string", "example": "string" }, "destination_ip": { "type": "string", "example": "string" }, "source_port": { "type": "integer", "format": "int64", "example": 10 }, "destination_port": { "type": "integer", "format": "int64", "example": 10 }, "direction": { "type": "string", "enum": [ "incoming", "outgoing" ], "example": "incoming" }, "destination_host_name": { "type": "string", "example": "string" }, "source_subnet": { "type": "string", "example": "string" }, "destination_subnet": { "type": "string", "example": "string" } }, "required": [ "protocol", "source_ip", "destination_ip", "source_port", "destination_port", "direction" ], "example": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 } }, "url_port": { "type": "integer", "format": "int64", "example": 10 }, "query": { "type": "string", "example": "string", "description": "String with at most 5000 characters." }, "encrypted": { "type": "boolean", "example": true }, "method": { "type": "string", "enum": [ "CONNECT", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT", "TRACE" ], "example": "CONNECT" } }, "required": [ "time", "process_id", "process_name", "type", "host", "traffic" ], "example": { "process_guid": 10, "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "method": "CONNECT", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "HTTPEvent", "host": "string", "process_name": "string", "process_id": 10, "process_username": "string", "query": "string", "encrypted": true, "url_port": 10 } }, "example": [ { "process_guid": 10, "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "method": "CONNECT", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "HTTPEvent", "host": "string", "process_name": "string", "process_id": 10, "process_username": "string", "query": "string", "encrypted": true, "url_port": 10 } ], "description": "a list of `HTTPType`" }, "registry_create_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "registry_key": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "type": { "type": "string", "enum": [ "RegistryCreateEvent" ], "example": "RegistryCreateEvent" } }, "required": [ "time", "process_id", "process_name", "registry_key", "type" ], "example": { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryCreateEvent" } }, "example": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryCreateEvent" } ], "description": "a list of `RegistryCreateType`" }, "registry_set_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "registry_key": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "type": { "type": "string", "enum": [ "RegistrySetEvent" ], "example": "RegistrySetEvent" }, "registry_value": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "registry_data_length": { "type": "integer", "format": "int64", "example": 10 }, "registry_data": { "type": "string", "example": "string", "description": "String with at most 5000 characters." } }, "required": [ "time", "process_id", "process_name", "registry_key", "type", "registry_value" ], "example": { "process_guid": 10, "registry_data": "string", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "RegistrySetEvent", "registry_data_length": 10, "registry_value": "string", "registry_key": "string", "process_name": "string", "process_id": 10, "process_username": "string" } }, "example": [ { "process_guid": 10, "registry_data": "string", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "RegistrySetEvent", "registry_data_length": 10, "registry_value": "string", "registry_key": "string", "process_name": "string", "process_id": 10, "process_username": "string" } ], "description": "a list of `RegistrySetType`" }, "registry_delete_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "registry_key": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "type": { "type": "string", "enum": [ "RegistryDeleteEvent" ], "example": "RegistryDeleteEvent" }, "registry_value": { "type": "string", "example": "string", "description": "String with at most 2048 characters." } }, "required": [ "time", "process_id", "process_name", "registry_key", "type" ], "example": { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryDeleteEvent", "registry_value": "string" } }, "example": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryDeleteEvent", "registry_value": "string" } ], "description": "a list of `RegistryDeleteType`" }, "registry_rename_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "registry_key": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "type": { "type": "string", "enum": [ "RegistryRenameEvent" ], "example": "RegistryRenameEvent" }, "registry_old_key": { "type": "string", "example": "string", "description": "String with at most 1024 characters." } }, "required": [ "time", "process_id", "process_name", "registry_key", "type", "registry_old_key" ], "example": { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryRenameEvent", "registry_old_key": "string" } }, "example": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryRenameEvent", "registry_old_key": "string" } ], "description": "a list of `RegistryRenameType`" } }, "example": { "http_events": [ { "process_guid": 10, "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "method": "CONNECT", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "HTTPEvent", "host": "string", "process_name": "string", "process_id": 10, "process_username": "string", "query": "string", "encrypted": true, "url_port": 10 } ], "process_create_events": [ { "parent_process_name": "string", "process_guid": 10, "parent_process_guid": 10, "process_disposition": "string", "parent_process_size": 10, "process_size": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_disposition": "string", "type": "ProcessCreateEvent", "parent_process_username": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "parent_creation_time": "2016-01-01T01:01:01Z", "process_args": "string" } ], "registry_delete_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryDeleteEvent", "registry_value": "string" } ], "file_modify_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileModifyEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "registry_set_events": [ { "process_guid": 10, "registry_data": "string", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "RegistrySetEvent", "registry_data_length": 10, "registry_value": "string", "registry_key": "string", "process_name": "string", "process_id": 10, "process_username": "string" } ], "file_create_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileCreateEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "registry_create_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryCreateEvent" } ], "library_load_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "type": "LibraryLoadEvent", "dll_library_name": "string", "dll_library_path": "string" } ], "file_move_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileMoveEvent", "old_name": "string", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "new_name": "string" } ], "file_delete_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileDeleteEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "netflow_events": [ { "parent_process_name": "string", "byte_count_in": 10, "process_guid": 10, "process_path": "string", "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "flow_time": "2016-01-01T01:01:01Z", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_account": "string", "type": "NetflowEvent", "process_account_type": "string", "parent_process_path": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_account": "string", "parent_process_account_type": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "byte_count_out": 10, "process_args": "string" } ], "registry_rename_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryRenameEvent", "registry_old_key": "string" } ] }, "description": "Context including the event type that best fits the type of the sighting." }, "activity_interval": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "The time interval during which the malicious activity occurred. For example, the time when a malware sample was executing, or the time range of a network intrusion." }, "detection_interval": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "The time interval during which the malicious activity was detected by the source engine or security tool. This may differ from the activity_interval if detection occurred after the activity." }, "modification_interval": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "The time interval during which the sighting record was created or last updated in the system." } }, "required": [ "observed_time" ], "example": { "description": "string", "schema_version": "1.3.30", "revision": 10, "relations": [ { "origin": "string", "origin_uri": "string", "relation": "Allocated", "relation_info": { "keyword": "anything" }, "source": { "value": "1.2.3.4", "type": "ip" }, "related": { "value": "1.2.3.4", "type": "ip" } } ], "sensor_coordinates": { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "os": "string" }, "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "type": "sighting", "source": "string", "external_ids": [ "string" ], "targets": [ { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "os": "string" } ], "short_description": "string", "title": "string", "resolution": "detected", "internal": false, "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "detection_interval": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "source_uri": "string", "activity_interval": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "language": "string", "id": "string", "count": 10, "severity": "Critical", "tlp": "green", "modification_interval": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "context": { "http_events": [ { "process_guid": 10, "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "method": "CONNECT", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "HTTPEvent", "host": "string", "process_name": "string", "process_id": 10, "process_username": "string", "query": "string", "encrypted": true, "url_port": 10 } ], "process_create_events": [ { "parent_process_name": "string", "process_guid": 10, "parent_process_guid": 10, "process_disposition": "string", "parent_process_size": 10, "process_size": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_disposition": "string", "type": "ProcessCreateEvent", "parent_process_username": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "parent_creation_time": "2016-01-01T01:01:01Z", "process_args": "string" } ], "registry_delete_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryDeleteEvent", "registry_value": "string" } ], "file_modify_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileModifyEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "registry_set_events": [ { "process_guid": 10, "registry_data": "string", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "RegistrySetEvent", "registry_data_length": 10, "registry_value": "string", "registry_key": "string", "process_name": "string", "process_id": 10, "process_username": "string" } ], "file_create_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileCreateEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "registry_create_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryCreateEvent" } ], "library_load_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "type": "LibraryLoadEvent", "dll_library_name": "string", "dll_library_path": "string" } ], "file_move_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileMoveEvent", "old_name": "string", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "new_name": "string" } ], "file_delete_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileDeleteEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "netflow_events": [ { "parent_process_name": "string", "byte_count_in": 10, "process_guid": 10, "process_path": "string", "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "flow_time": "2016-01-01T01:01:01Z", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_account": "string", "type": "NetflowEvent", "process_account_type": "string", "parent_process_path": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_account": "string", "parent_process_account_type": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "byte_count_out": 10, "process_args": "string" } ], "registry_rename_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryRenameEvent", "registry_old_key": "string" } ] }, "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "sensor": "endpoint", "data": { "columns": [ { "name": "string", "type": "integer", "description": "string", "required": true, "short_description": "string" } ], "rows": [ [ "anything" ] ], "row_count": 10 } }, "description": "For submitting a new Sighting." }, "uniqueItems": true, "example": [ { "description": "string", "schema_version": "1.3.30", "revision": 10, "relations": [ { "origin": "string", "origin_uri": "string", "relation": "Allocated", "relation_info": { "keyword": "anything" }, "source": { "value": "1.2.3.4", "type": "ip" }, "related": { "value": "1.2.3.4", "type": "ip" } } ], "sensor_coordinates": { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "os": "string" }, "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "type": "sighting", "source": "string", "external_ids": [ "string" ], "targets": [ { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "os": "string" } ], "short_description": "string", "title": "string", "resolution": "detected", "internal": false, "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "detection_interval": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "source_uri": "string", "activity_interval": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "language": "string", "id": "string", "count": 10, "severity": "Critical", "tlp": "green", "modification_interval": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "context": { "http_events": [ { "process_guid": 10, "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "method": "CONNECT", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "HTTPEvent", "host": "string", "process_name": "string", "process_id": 10, "process_username": "string", "query": "string", "encrypted": true, "url_port": 10 } ], "process_create_events": [ { "parent_process_name": "string", "process_guid": 10, "parent_process_guid": 10, "process_disposition": "string", "parent_process_size": 10, "process_size": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_disposition": "string", "type": "ProcessCreateEvent", "parent_process_username": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "parent_creation_time": "2016-01-01T01:01:01Z", "process_args": "string" } ], "registry_delete_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryDeleteEvent", "registry_value": "string" } ], "file_modify_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileModifyEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "registry_set_events": [ { "process_guid": 10, "registry_data": "string", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "RegistrySetEvent", "registry_data_length": 10, "registry_value": "string", "registry_key": "string", "process_name": "string", "process_id": 10, "process_username": "string" } ], "file_create_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileCreateEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "registry_create_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryCreateEvent" } ], "library_load_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "type": "LibraryLoadEvent", "dll_library_name": "string", "dll_library_path": "string" } ], "file_move_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileMoveEvent", "old_name": "string", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "new_name": "string" } ], "file_delete_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileDeleteEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "netflow_events": [ { "parent_process_name": "string", "byte_count_in": 10, "process_guid": 10, "process_path": "string", "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "flow_time": "2016-01-01T01:01:01Z", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_account": "string", "type": "NetflowEvent", "process_account_type": "string", "parent_process_path": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_account": "string", "parent_process_account_type": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "byte_count_out": 10, "process_args": "string" } ], "registry_rename_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryRenameEvent", "registry_old_key": "string" } ] }, "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "sensor": "endpoint", "data": { "columns": [ { "name": "string", "type": "integer", "description": "string", "required": true, "short_description": "string" } ], "rows": [ [ "anything" ] ], "row_count": 10 } } ], "description": "a list of `NewSighting`s." }, "identity_assertions": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "identity-assertion" ], "example": "identity-assertion", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "identity": { "type": "object", "properties": { "observables": { "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." }, "example": [ { "value": "1.2.3.4", "type": "ip" } ] } }, "required": [ "observables" ], "example": { "observables": [ { "value": "1.2.3.4", "type": "ip" } ] }, "description": "Attributes for which the assertion is being made." }, "assertions": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string", "example": "cisco:ctr:ad:host_domain_name", "description": "An open vocabulary containing well known assertion types" }, "value": { "type": "string", "example": "string" } }, "required": [ "name", "value" ], "example": { "name": "cisco:ctr:ad:host_domain_name", "value": "string" } }, "example": [ { "name": "cisco:ctr:ad:host_domain_name", "value": "string" } ], "description": "Any known context about the identity attributes." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid." } }, "required": [ "identity", "assertions" ], "example": { "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "identity": { "observables": [ { "value": "1.2.3.4", "type": "ip" } ] }, "schema_version": "1.3.30", "revision": 10, "type": "identity-assertion", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "assertions": [ { "name": "cisco:ctr:ad:host_domain_name", "value": "string" } ] }, "description": "For submitting a new IdentityAssertion." }, "uniqueItems": true, "example": [ { "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "identity": { "observables": [ { "value": "1.2.3.4", "type": "ip" } ] }, "schema_version": "1.3.30", "revision": 10, "type": "identity-assertion", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "assertions": [ { "name": "cisco:ctr:ad:host_domain_name", "value": "string" } ] } ], "description": "a list of `NewIdentityAssertion`s." }, "target_records": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "target-record" ], "example": "target-record", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "targets": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "endpoint", "description": "The sensor/actuator name that best fits a device." }, "observables": { "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." }, "example": [ { "value": "1.2.3.4", "type": "ip" } ] }, "observed_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "os": { "type": "string", "example": "string", "description": "Source Operating System where TargetRecord was originated." }, "internal": { "type": "boolean", "example": false, "description": "Is it internal to our network?" }, "sensor": { "type": "string", "example": "string", "description": "The OpenC2 Actuator name that best fits the device that is creating this TargetRecord (e.g.: network.firewall, etc.)" }, "source_uri": { "type": "string", "example": "string", "description": "A URI" } }, "required": [ "type", "observables", "observed_time" ], "example": { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "os": "string", "internal": false, "sensor": "string", "source_uri": "string" }, "description": "Schema for TargetRecord Targets" }, "example": [ { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "os": "string", "internal": false, "sensor": "string", "source_uri": "string" } ] } }, "required": [ "source", "targets" ], "example": { "description": "string", "schema_version": "1.3.30", "revision": 10, "type": "target-record", "source": "string", "external_ids": [ "string" ], "targets": [ { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "os": "string", "internal": false, "sensor": "string", "source_uri": "string" } ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z" }, "description": "Schema for submitting new TargetRecord." }, "uniqueItems": true, "example": [ { "description": "string", "schema_version": "1.3.30", "revision": 10, "type": "target-record", "source": "string", "external_ids": [ "string" ], "targets": [ { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "os": "string", "internal": false, "sensor": "string", "source_uri": "string" } ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z" } ], "description": "a list of `NewTargetRecord`s." }, "tools": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "tool" ], "example": "tool", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "labels": { "type": "array", "items": { "type": "string", "example": "credential-exploitation", "description": "Tool labels describe the categories of tools that can be used to perform attacks." }, "example": [ "credential-exploitation" ], "description": "The kind(s) of tool(s) being described." }, "kill_chain_phases": { "type": "array", "items": { "type": "object", "properties": { "kill_chain_name": { "type": "string", "example": "string", "description": "The name of the kill chain." }, "phase_name": { "type": "string", "example": "string", "description": "The name of the phase in the kill chain." } }, "required": [ "kill_chain_name", "phase_name" ], "example": { "kill_chain_name": "string", "phase_name": "string" }, "description": "The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives." }, "example": [ { "kill_chain_name": "string", "phase_name": "string" } ], "description": "The list of kill chain phases for which this Tool can be used." }, "tool_version": { "type": "string", "example": "string", "description": "The version identifier associated with the Tool." }, "x_mitre_aliases": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "ATT&CK Software.aliases." } }, "required": [ "title", "description", "short_description", "labels" ], "example": { "description": "string", "labels": [ "credential-exploitation" ], "schema_version": "1.3.30", "revision": 10, "type": "tool", "x_mitre_aliases": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tool_version": "string", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "timestamp": "2016-01-01T01:01:01Z" }, "description": "For submitting a new Tool." }, "uniqueItems": true, "example": [ { "description": "string", "labels": [ "credential-exploitation" ], "schema_version": "1.3.30", "revision": 10, "type": "tool", "x_mitre_aliases": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tool_version": "string", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "timestamp": "2016-01-01T01:01:01Z" } ], "description": "a list of `NewTool`s." }, "verdicts": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "verdict" ], "example": "verdict" }, "disposition": { "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Numeric verdict identifiers." }, "observable": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." }, "judgement_id": { "type": "string", "example": "string", "description": "A URI leading to a judgement." }, "disposition_name": { "type": "string", "enum": [ "Clean", "Common", "Malicious", "Suspicious", "Unknown" ], "example": "Clean", "description": "The disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 \"Clean\", 2 \"Malicious\", 3 \"Suspicious\", 4 \"Common\", 5 \"Unknown\"}" }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid." } }, "required": [ "type", "disposition", "observable", "valid_time" ], "example": { "type": "verdict", "disposition": 1, "observable": { "value": "1.2.3.4", "type": "ip" }, "judgement_id": "string", "disposition_name": "Clean", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" } }, "description": "A Verdict is chosen from all of the Judgements on that Observable which have not yet expired. The highest priority Judgement becomes the active verdict. If there is more than one Judgement with that priority, then Clean disposition has priority over all others, then Malicious disposition, and so on down to Unknown.\n\n The ID of a verdict is a a str of the form \"observable.type:observable.value\" for example, \"ip:1.1.1.1\"" }, "uniqueItems": true, "example": [ { "type": "verdict", "disposition": 1, "observable": { "value": "1.2.3.4", "type": "ip" }, "judgement_id": "string", "disposition_name": "Clean", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" } } ], "description": "a list of `Verdict`s." }, "data_tables": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "data-table" ], "example": "data-table", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "columns": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string", "example": "string" }, "type": { "type": "string", "enum": [ "integer", "markdown", "number", "observable", "string", "url" ], "example": "integer" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "required": { "type": "boolean", "example": true, "description": "If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`." }, "short_description": { "type": "string", "example": "string" } }, "required": [ "name", "type" ], "example": { "name": "string", "type": "integer", "description": "string", "required": true, "short_description": "string" } }, "example": [ { "name": "string", "type": "integer", "description": "string", "required": true, "short_description": "string" } ], "description": "An ordered list of column definitions." }, "rows": { "type": "array", "items": { "type": "array", "items": { "example": "anything" } }, "example": [ [ "anything" ] ], "description": "An ordered list of rows" }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid." }, "row_count": { "type": "integer", "format": "int64", "example": 10, "description": "The number of rows in the data table." } }, "required": [ "columns", "rows" ], "example": { "description": "string", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "columns": [ { "name": "string", "type": "integer", "description": "string", "required": true, "short_description": "string" } ], "type": "data-table", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "rows": [ [ "anything" ] ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "row_count": 10, "timestamp": "2016-01-01T01:01:01Z" }, "description": "Schema for submitting a NewDataTable record." }, "uniqueItems": true, "example": [ { "description": "string", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "columns": [ { "name": "string", "type": "integer", "description": "string", "required": true, "short_description": "string" } ], "type": "data-table", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "rows": [ [ "anything" ] ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "row_count": 10, "timestamp": "2016-01-01T01:01:01Z" } ], "description": "a list of `NewDataTable`s." }, "weaknesses": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "weakness" ], "example": "weakness", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "Should be short and limited to the key points that define this weakness." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "structure": { "type": "string", "enum": [ "Chain", "Composite", "Simple" ], "example": "Chain", "description": "Defines the structural nature of the weakness." }, "languages": { "type": "array", "items": { "type": "object", "properties": { "prevalence": { "type": "string", "enum": [ "Often", "Rarely", "Sometimes", "Undetermined" ], "example": "Often", "description": "Defines the different regularities that guide the applicability of platforms." }, "name": { "type": "string", "example": "string", "description": "Language name (Clojure, Java, ...)" }, "class": { "type": "string", "example": "Assembly", "description": "Class of language." } }, "required": [ "prevalence" ], "example": { "prevalence": "Often", "name": "string", "class": "Assembly" } }, "example": [ { "prevalence": "Often", "name": "string", "class": "Assembly" } ], "description": "Applicable Languages." }, "operating_systems": { "type": "array", "items": { "type": "object", "properties": { "prevalence": { "type": "string", "enum": [ "Often", "Rarely", "Sometimes", "Undetermined" ], "example": "Often", "description": "Defines the different regularities that guide the applicability of platforms." }, "name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "version": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "cpe_id": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "class": { "type": "string", "example": "Android", "description": "Class of Operating System." } }, "required": [ "prevalence" ], "example": { "prevalence": "Often", "name": "string", "version": "string", "cpe_id": "string", "class": "Android" } }, "example": [ { "prevalence": "Often", "name": "string", "version": "string", "cpe_id": "string", "class": "Android" } ], "description": "Applicable operating systems." }, "architectures": { "type": "array", "items": { "type": "object", "properties": { "prevalence": { "type": "string", "enum": [ "Often", "Rarely", "Sometimes", "Undetermined" ], "example": "Often", "description": "Defines the different regularities that guide the applicability of platforms." }, "name": { "type": "string", "example": "string", "description": "Architecture name (ARM, x86, ...)" }, "class": { "type": "string", "example": "Embedded", "description": "Class of architecture" } }, "required": [ "prevalence" ], "example": { "prevalence": "Often", "name": "string", "class": "Embedded" } }, "example": [ { "prevalence": "Often", "name": "string", "class": "Embedded" } ], "description": "Applicable architectures." }, "paradigms": { "type": "array", "items": { "type": "object", "properties": { "prevalence": { "type": "string", "enum": [ "Often", "Rarely", "Sometimes", "Undetermined" ], "example": "Often", "description": "Defines the different regularities that guide the applicability of platforms." }, "name": { "type": "string", "example": "string", "description": "Paradigm name (Client Server, Mainframe)" } }, "required": [ "prevalence" ], "example": { "prevalence": "Often", "name": "string" } }, "example": [ { "prevalence": "Often", "name": "string" } ], "description": "Applicable paradigms." }, "technologies": { "type": "array", "items": { "type": "object", "properties": { "prevalence": { "type": "string", "enum": [ "Often", "Rarely", "Sometimes", "Undetermined" ], "example": "Often", "description": "Defines the different regularities that guide the applicability of platforms." }, "name": { "type": "string", "example": "string", "description": "Technology name (Web Server, Web Client)" } }, "required": [ "prevalence" ], "example": { "prevalence": "Often", "name": "string" } }, "example": [ { "prevalence": "Often", "name": "string" } ], "description": "Applicable technologies." }, "background_details": { "type": "string", "example": "string", "description": "Information that is relevant but not related to the nature of the weakness itself." }, "alternate_terms": { "type": "array", "items": { "type": "object", "properties": { "term": { "type": "string", "example": "string", "description": "The actual alternate term." }, "description": { "type": "string", "example": "string", "description": "Provides context for the alternate term by which this weakness may be known." } }, "required": [ "term" ], "example": { "term": "string", "description": "string" } }, "example": [ { "term": "string", "description": "string" } ], "description": "Indicates one or more other names used to describe this weakness." }, "modes_of_introduction": { "type": "array", "items": { "type": "object", "properties": { "phase": { "type": "string", "example": "Architecture and Design", "description": "Identifies the point in the software life cycle at which the weakness may be introduced." }, "note": { "type": "string", "example": "string", "description": "Provides a typical scenario related to introduction during the given phase." } }, "required": [ "phase" ], "example": { "phase": "Architecture and Design", "note": "string" } }, "example": [ { "phase": "Architecture and Design", "note": "string" } ], "description": "Information about how and when a given weakness may be introduced." }, "likelihood": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "Likelihood of exploit." }, "common_consequences": { "type": "array", "items": { "type": "object", "properties": { "scopes": { "type": "array", "items": { "type": "string", "example": "Access Control", "description": "Defines the different areas of software security that can be affected by exploiting a weakness." }, "example": [ "Access Control" ], "description": "Identifies the security property that is violated." }, "impacts": { "type": "array", "items": { "type": "string", "example": "Alter Execution Logic" }, "example": [ "Alter Execution Logic" ], "description": "Describes the technical impact that arises if an adversary succeeds in exploiting this weakness." }, "likelihood": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "How likely the specific consequence is expected to be seen relative to the other consequences." }, "note": { "type": "string", "example": "string", "description": "Additional commentary about a consequence." } }, "required": [ "scopes" ], "example": { "scopes": [ "Access Control" ], "impacts": [ "Alter Execution Logic" ], "likelihood": "High", "note": "string" } }, "example": [ { "scopes": [ "Access Control" ], "impacts": [ "Alter Execution Logic" ], "likelihood": "High", "note": "string" } ], "description": "Refers to the typical or expected negative effects that can result from exploiting the weakness. This could include anything from unauthorized access to data, denial of service, system crashes or other things." }, "detection_methods": { "type": "array", "items": { "type": "object", "properties": { "method": { "type": "string", "example": "Architecture or Design Review", "description": "Identifies the particular detection method being described." }, "description": { "type": "string", "example": "string", "description": "Provides some context of how this method can be applied to a specific weakness." }, "effectiveness": { "type": "string", "example": "High", "description": "How effective the detection method may be in detecting the associated weakness." }, "effectiveness_notes": { "type": "string", "example": "string", "description": "Provides additional discussion of the strengths and shortcomings of this detection method." } }, "required": [ "method", "description" ], "example": { "method": "Architecture or Design Review", "description": "string", "effectiveness": "High", "effectiveness_notes": "string" } }, "example": [ { "method": "Architecture or Design Review", "description": "string", "effectiveness": "High", "effectiveness_notes": "string" } ], "description": "Identifies methods that may be employed to detect this weakness, including their strengths and limitations." }, "potential_mitigations": { "type": "array", "items": { "type": "object", "properties": { "description": { "type": "string", "example": "string", "description": "A description of this individual mitigation including any strengths and shortcomings of this mitigation for the weakness." }, "phases": { "type": "array", "items": { "type": "string", "example": "Architecture and Design", "description": "Defines the different regularities that guide the applicability of platforms." }, "example": [ "Architecture and Design" ], "description": "Indicates the development life cycle phase during which this particular mitigation may be applied." }, "strategy": { "type": "string", "example": "Attack Surface Reduction", "description": "A general strategy for protecting a system to which this mitigation contributes." }, "effectiveness": { "type": "string", "example": "Defense in Depth", "description": "Summarizes how effective the mitigation may be in preventing the weakness." }, "effectiveness_notes": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." } }, "required": [ "description" ], "example": { "description": "string", "phases": [ "Architecture and Design" ], "strategy": "Attack Surface Reduction", "effectiveness": "Defense in Depth", "effectiveness_notes": "string" } }, "example": [ { "description": "string", "phases": [ "Architecture and Design" ], "strategy": "Attack Surface Reduction", "effectiveness": "Defense in Depth", "effectiveness_notes": "string" } ], "description": "Describes potential mitigations associated with a weakness." }, "functional_areas": { "type": "array", "items": { "type": "string", "example": "Authentication", "description": "Defines the different functional areas of software in which the weakness may appear." }, "example": [ "Authentication" ], "description": "Identifies the functional area of the software in which the weakness is most likely to occur." }, "affected_resources": { "type": "array", "items": { "type": "string", "example": "CPU", "description": "Defines a resource of a system." }, "example": [ "CPU" ], "description": "Identifies system resources that can be affected by an exploit of this weakness." }, "notes": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "Applicable Platform", "description": "Defines the different types of notes that can be associated with a weakness." }, "note": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." } }, "required": [ "type", "note" ], "example": { "type": "Applicable Platform", "note": "string" } }, "example": [ { "type": "Applicable Platform", "note": "string" } ], "description": "Provides any additional comments about the weakness." }, "abstraction_level": { "type": "string", "enum": [ "Base", "Class", "Compound", "Variant" ], "example": "Base", "description": "Refers to the level of abstraction or granularity used to describe the weakness. It helps to categorize the vulnerability based on the level of detail provided." } }, "required": [ "description" ], "example": { "description": "string", "background_details": "string", "paradigms": [ { "prevalence": "Often", "name": "string" } ], "abstraction_level": "Base", "architectures": [ { "prevalence": "Often", "name": "string", "class": "Embedded" } ], "schema_version": "1.3.30", "revision": 10, "alternate_terms": [ { "term": "string", "description": "string" } ], "likelihood": "High", "type": "weakness", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "functional_areas": [ "Authentication" ], "source_uri": "string", "modes_of_introduction": [ { "phase": "Architecture and Design", "note": "string" } ], "structure": "Chain", "language": "string", "id": "string", "notes": [ { "type": "Applicable Platform", "note": "string" } ], "common_consequences": [ { "scopes": [ "Access Control" ], "impacts": [ "Alter Execution Logic" ], "likelihood": "High", "note": "string" } ], "tlp": "green", "detection_methods": [ { "method": "Architecture or Design Review", "description": "string", "effectiveness": "High", "effectiveness_notes": "string" } ], "operating_systems": [ { "prevalence": "Often", "name": "string", "version": "string", "cpe_id": "string", "class": "Android" } ], "affected_resources": [ "CPU" ], "languages": [ { "prevalence": "Often", "name": "string", "class": "Assembly" } ], "timestamp": "2016-01-01T01:01:01Z", "potential_mitigations": [ { "description": "string", "phases": [ "Architecture and Design" ], "strategy": "Attack Surface Reduction", "effectiveness": "Defense in Depth", "effectiveness_notes": "string" } ], "technologies": [ { "prevalence": "Often", "name": "string" } ] }, "description": "For submitting a new weakness." }, "uniqueItems": true, "example": [ { "description": "string", "background_details": "string", "paradigms": [ { "prevalence": "Often", "name": "string" } ], "abstraction_level": "Base", "architectures": [ { "prevalence": "Often", "name": "string", "class": "Embedded" } ], "schema_version": "1.3.30", "revision": 10, "alternate_terms": [ { "term": "string", "description": "string" } ], "likelihood": "High", "type": "weakness", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "functional_areas": [ "Authentication" ], "source_uri": "string", "modes_of_introduction": [ { "phase": "Architecture and Design", "note": "string" } ], "structure": "Chain", "language": "string", "id": "string", "notes": [ { "type": "Applicable Platform", "note": "string" } ], "common_consequences": [ { "scopes": [ "Access Control" ], "impacts": [ "Alter Execution Logic" ], "likelihood": "High", "note": "string" } ], "tlp": "green", "detection_methods": [ { "method": "Architecture or Design Review", "description": "string", "effectiveness": "High", "effectiveness_notes": "string" } ], "operating_systems": [ { "prevalence": "Often", "name": "string", "version": "string", "cpe_id": "string", "class": "Android" } ], "affected_resources": [ "CPU" ], "languages": [ { "prevalence": "Often", "name": "string", "class": "Assembly" } ], "timestamp": "2016-01-01T01:01:01Z", "potential_mitigations": [ { "description": "string", "phases": [ "Architecture and Design" ], "strategy": "Attack Surface Reduction", "effectiveness": "Defense in Depth", "effectiveness_notes": "string" } ], "technologies": [ { "prevalence": "Often", "name": "string" } ] } ], "description": "a list of `NewWeakness`s." }, "vulnerabilities": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "vulnerability" ], "example": "vulnerability", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "Various sources of vulnerability information can be used, including third-party resources like the National Vulnerability Database (NVD) and the Common Vulnerabilities and Exposures (CVE) database. The platform then analyzes this data and provides the user with relevant details such as the severity of the vulnerability, the affected systems, and remediation recommendations. \n\n Based on this information, the user can prioritize patching and other mitigation strategies to reduce the risk of potential attacks." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "cve": { "type": "object", "properties": { "cve_data_meta": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "assigner": { "type": "string", "example": "string", "description": "String with at most 1024 characters." } }, "example": { "id": "string", "assigner": "string" } } }, "required": [ "cve_data_meta" ], "example": { "cve_data_meta": { "id": "string", "assigner": "string" } } }, "impact": { "type": "object", "properties": { "cvss_v2": { "type": "object", "properties": { "vector_string": { "type": "string", "example": "string", "description": "a text representation of a set of CVSSv2 metrics. It is commonly used to record or transfer CVSSv2 metric information in a concise form" }, "base_score": { "type": "number", "format": "double", "example": 10.0, "description": "The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v2/guide" }, "base_severity": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "impact_score": { "type": "number", "format": "double", "example": 10.0, "description": "a Score number from 0 to 10" }, "exploitability_score": { "type": "number", "format": "double", "example": 10.0, "description": "a Score number from 0 to 10" }, "access_vector": { "type": "string", "enum": [ "adjacent network", "local", "network" ], "example": "network", "description": "This metric reflects how the vulnerability is exploited.The more remote an attacker can be to attack a host, the greater the vulnerability score." }, "access_complexity": { "type": "string", "enum": [ "high", "low", "medium" ], "example": "low", "description": "This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system. For example, consider a buffer overflow in an Internet service: once the target system is located, the attacker can launch an exploit at will." }, "authentication": { "type": "string", "enum": [ "multiple", "none", "single" ], "example": "none", "description": "This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. This metric does not gauge the strength or complexity of the authentication process, only that an attacker is required to provide credentials before an exploit may occur. The fewer authentication instances that are required, the higher the vulnerability score." }, "confidentiality_impact": { "type": "string", "enum": [ "complete", "none", "partial" ], "example": "complete", "description": "This metric measures the impact on confidentiality of a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. Increasedconfidentiality impact increases the vulnerability score." }, "integrity_impact": { "type": "string", "enum": [ "complete", "none", "partial" ], "example": "complete", "description": "This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information. Increased integrity impact increases the vulnerability score." }, "availability_impact": { "type": "string", "enum": [ "complete", "none", "partial" ], "example": "complete", "description": "This metric measures the impact to availability of a successfully exploited vulnerability. Availability refers to the accessibility of information resources. Attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system. Increased availability impact increases the vulnerability score." }, "exploitability": { "type": "string", "enum": [ "functional", "high", "not_defined", "proof_of_concept", "unproven" ], "example": "not_defined", "description": "This metric measures the current state of exploit techniques or code availability. Public availability of easy-to-use exploit code increases the number of potential attackers by including those who are unskilled thereby increasing the severity of the vulnerability." }, "remediation_level": { "type": "string", "enum": [ "not_defined", "official_fix", "temporary_fix", "unavailable", "workaround" ], "example": "not_defined", "description": "The remediation level of a vulnerability is an important factor for prioritization. The typical vulnerability is unpatched when initially published. Workarounds or hotfixes may offer interim remediation until an official patch or upgrade is issued. Each of these respective stages adjusts the temporal score downwards, reflecting the decreasing urgency as remediation becomes final. The less official and permanent a fix, the higher the vulnerability score is." }, "report_confidence": { "type": "string", "enum": [ "confirmed", "not_defined", "unconfirmed", "uncorroborated" ], "example": "not_defined", "description": "This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details. Sometimes, only the existence of vulnerabilities are publicized, but without specific details. The vulnerability may later be corroborated and then confirmed through acknowledgement by the author or vendor of the affected technology. The urgency of a vulnerability is higher when a vulnerability is known to exist with certainty. This metric also suggests the level of technical knowledge available to would-be attackers. The more a vulnerability is validated by the vendor or other reputable sources, the higher the score." }, "temporal_vector_string": { "type": "string", "example": "string", "description": "A text representation of a set of CVSSv2 temporal metrics. Temporal metrics allow analysists to calculate threat severity based on temporal factors such as reliability of vulnerability reports, availability of mitigations, and the ease or difficulty of conducting the exploit. It is commonly used to record or transfer CVSSv2 metric information in a concise form" }, "collateral_damage_potential": { "type": "string", "enum": [ "high", "low", "low_medium", "medium_high", "none", "not_defined" ], "example": "not_defined", "description": "This metric measures the potential for loss of life or physical assets through damage or theft of property or equipment. The metric may also measure economic loss of productivity or revenue. Naturally, the greater the damage potential, the higher the vulnerability score." }, "target_distribution": { "type": "string", "enum": [ "high", "low", "medium", "none", "not_defined" ], "example": "not_defined", "description": "This metric measures the proportion of vulnerable systems. It is meant as an environment-specific indicator in order to approximate the percentage of systems that could be affected by the vulnerability. The greater the proportion of vulnerable systems, the higher the score." }, "confidentiality_requirement": { "type": "string", "enum": [ "high", "low", "medium", "not_defined" ], "example": "not_defined", "description": "These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high." }, "integrity_requirement": { "type": "string", "enum": [ "high", "low", "medium", "not_defined" ], "example": "not_defined", "description": "These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high." }, "availability_requirement": { "type": "string", "enum": [ "high", "low", "medium", "not_defined" ], "example": "not_defined", "description": "These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high." }, "environmental_vector_string": { "type": "string", "example": "string", "description": "A text representation of a set of CVSSv2 environmental metrics. Environmental metrics allow analysists to calculate threat scores in relation to environmental security requirements, collateral damage potential, and target availability. It is commonly used to record or transfer CVSSv2 metric information in a concise form" }, "obtain_all_privilege": { "type": "boolean", "example": true }, "obtain_user_privilege": { "type": "boolean", "example": true }, "obtain_other_privilege": { "type": "boolean", "example": true }, "user_interaction_required": { "type": "boolean", "example": true } }, "required": [ "vector_string", "base_score", "base_severity" ], "example": { "integrity_impact": "complete", "target_distribution": "not_defined", "availability_requirement": "not_defined", "exploitability": "not_defined", "access_complexity": "low", "temporal_vector_string": "string", "exploitability_score": 10.0, "impact_score": 10.0, "user_interaction_required": true, "environmental_vector_string": "string", "obtain_other_privilege": true, "availability_impact": "complete", "access_vector": "network", "base_severity": "High", "confidentiality_impact": "complete", "confidentiality_requirement": "not_defined", "report_confidence": "not_defined", "authentication": "none", "base_score": 10.0, "obtain_user_privilege": true, "obtain_all_privilege": true, "collateral_damage_potential": "not_defined", "remediation_level": "not_defined", "vector_string": "string", "integrity_requirement": "not_defined" } }, "cvss_v3": { "type": "object", "properties": { "vector_string": { "type": "string", "example": "string", "description": "a text representation of a set of CVSSv3 metrics. It is commonly used to record or transfer CVSSv3 metric information in a concise form" }, "base_score": { "type": "number", "format": "double", "example": 10.0, "description": "The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v3-1" }, "base_severity": { "type": "string", "enum": [ "critical", "high", "low", "medium", "none" ], "example": "critical" }, "impact_score": { "type": "number", "format": "double", "example": 10.0, "description": "a Score number from 0 to 10" }, "exploitability_score": { "type": "number", "format": "double", "example": 10.0, "description": "a Score number from 0 to 10" }, "attack_vector": { "type": "string", "enum": [ "adjacent_network", "local", "network", "physical" ], "example": "adjacent_network", "description": "Reflects the context by which vulnerability exploitation is possible" }, "modified_attack_vector": { "type": "string", "enum": [ "adjacent_network", "local", "network", "not_defined", "physical" ], "example": "not_defined", "description": "modified attack vector" }, "attack_complexity": { "type": "string", "enum": [ "high", "low" ], "example": "high", "description": "describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability" }, "modified_attack_complexity": { "type": "string", "enum": [ "high", "low", "not_defined" ], "example": "not_defined", "description": "modified attack complexity" }, "privileges_required": { "type": "string", "enum": [ "high", "low", "none" ], "example": "high", "description": "describes the level of privileges an attacker must possess before successfully exploiting the vulnerability" }, "modified_privileges_required": { "type": "string", "enum": [ "high", "low", "none", "not_defined" ], "example": "not_defined", "description": "modified privileges required" }, "user_interaction": { "type": "string", "enum": [ "none", "required" ], "example": "none", "description": "captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component" }, "modified_user_interaction": { "type": "string", "enum": [ "none", "not_defined", "required" ], "example": "none", "description": "modified user interaction" }, "scope": { "type": "string", "enum": [ "changed", "unchanged" ], "example": "changed", "description": "the ability for a vulnerability in one software component to impact resources beyond its means, or privileges" }, "modified_scope": { "type": "string", "enum": [ "changed", "not_defined", "unchanged" ], "example": "not_defined", "description": "modified scope" }, "confidentiality_impact": { "type": "string", "enum": [ "high", "low", "none" ], "example": "high", "description": "measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability" }, "modified_confidentiality_impact": { "type": "string", "enum": [ "high", "low", "none", "not_defined" ], "example": "not_defined", "description": "modified confidentiality impact" }, "integrity_impact": { "type": "string", "enum": [ "high", "low", "none" ], "example": "high", "description": "measures the impact to integrity of a successfully exploited vulnerability" }, "modified_integrity_impact": { "type": "string", "enum": [ "high", "low", "none", "not_defined" ], "example": "not_defined", "description": "modified integrity impact" }, "availability_impact": { "type": "string", "enum": [ "high", "low", "none" ], "example": "high", "description": "measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability" }, "modified_availability_impact": { "type": "string", "enum": [ "high", "low", "none", "not_defined" ], "example": "not_defined", "description": "modified availability impact" }, "exploit_code_maturity": { "type": "string", "enum": [ "functional", "high", "not_defined", "proof_of_concept", "unproven" ], "example": "functional", "description": "measures the likelihood of the vulnerability being attacked" }, "remediation_level": { "type": "string", "enum": [ "high", "not_defined", "offical_fix", "temporary_fix", "unavailable", "workaround" ], "example": "high", "description": "Remediation Level of a vulnerability is an important factor for prioritization" }, "report_confidence": { "type": "string", "enum": [ "confirmed", "reasonable", "unknown" ], "example": "confirmed", "description": "measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details" }, "temporal_score": { "type": "number", "format": "double", "example": 10.0, "description": "Round up(CVSSv3BaseScore \u00d7 CVSSv3ExploitCodeMaturity \u00d7 CVSSv3RemediationLevel \u00d7 CVSSv3ReportConfidence)" }, "temporal_severity": { "type": "string", "enum": [ "critical", "high", "low", "medium", "none" ], "example": "critical", "description": "temporal severity" }, "availability_requirement": { "type": "string", "enum": [ "high", "low", "none", "not_defined" ], "example": "high", "description": "These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user's organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default)." }, "confidentiality_requirement": { "type": "string", "enum": [ "high", "low", "none", "not_defined" ], "example": "high", "description": "These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user's organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default)." }, "integrity_requirement": { "type": "string", "enum": [ "high", "low", "none", "not_defined" ], "example": "high", "description": "These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user's organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default)." }, "environmental_score": { "type": "number", "format": "double", "example": 10.0, "description": "a Score number from 0 to 10" }, "environmental_severity": { "type": "string", "enum": [ "critical", "high", "low", "medium", "none" ], "example": "critical" } }, "required": [ "vector_string", "base_score", "base_severity" ], "example": { "integrity_impact": "high", "modified_user_interaction": "none", "modified_scope": "not_defined", "availability_requirement": "high", "user_interaction": "none", "modified_integrity_impact": "not_defined", "privileges_required": "high", "exploitability_score": 10.0, "impact_score": 10.0, "environmental_severity": "critical", "modified_availability_impact": "not_defined", "availability_impact": "high", "scope": "changed", "exploit_code_maturity": "functional", "modified_attack_complexity": "not_defined", "base_severity": "critical", "confidentiality_impact": "high", "temporal_severity": "critical", "modified_confidentiality_impact": "not_defined", "confidentiality_requirement": "high", "report_confidence": "confirmed", "temporal_score": 10.0, "modified_privileges_required": "not_defined", "modified_attack_vector": "not_defined", "base_score": 10.0, "environmental_score": 10.0, "remediation_level": "high", "vector_string": "string", "integrity_requirement": "high", "attack_vector": "adjacent_network", "attack_complexity": "high" } } }, "example": { "cvss_v2": { "integrity_impact": "complete", "target_distribution": "not_defined", "availability_requirement": "not_defined", "exploitability": "not_defined", "access_complexity": "low", "temporal_vector_string": "string", "exploitability_score": 10.0, "impact_score": 10.0, "user_interaction_required": true, "environmental_vector_string": "string", "obtain_other_privilege": true, "availability_impact": "complete", "access_vector": "network", "base_severity": "High", "confidentiality_impact": "complete", "confidentiality_requirement": "not_defined", "report_confidence": "not_defined", "authentication": "none", "base_score": 10.0, "obtain_user_privilege": true, "obtain_all_privilege": true, "collateral_damage_potential": "not_defined", "remediation_level": "not_defined", "vector_string": "string", "integrity_requirement": "not_defined" }, "cvss_v3": { "integrity_impact": "high", "modified_user_interaction": "none", "modified_scope": "not_defined", "availability_requirement": "high", "user_interaction": "none", "modified_integrity_impact": "not_defined", "privileges_required": "high", "exploitability_score": 10.0, "impact_score": 10.0, "environmental_severity": "critical", "modified_availability_impact": "not_defined", "availability_impact": "high", "scope": "changed", "exploit_code_maturity": "functional", "modified_attack_complexity": "not_defined", "base_severity": "critical", "confidentiality_impact": "high", "temporal_severity": "critical", "modified_confidentiality_impact": "not_defined", "confidentiality_requirement": "high", "report_confidence": "confirmed", "temporal_score": 10.0, "modified_privileges_required": "not_defined", "modified_attack_vector": "not_defined", "base_score": 10.0, "environmental_score": 10.0, "remediation_level": "high", "vector_string": "string", "integrity_requirement": "high", "attack_vector": "adjacent_network", "attack_complexity": "high" } }, "description": "Describes the potential impact of a vulnerability that is being tracked in the system. Provides information on the extent of damage that a vulnerability can cause and how serious the consequences could be if it is exploited. \n\nMay contain granular information about the vulnerability severity using the CVSS system, versions 2 and 3.\n\nCVSSv2 and CVSSv3 have different methods of calculating base scores, but both are designed to provide an indication of the level of risk that a vulnerability poses. The base score ranges from 0 to 10, with 10 being the most severe. Additionally, both CVSSv2 and CVSSv3 define severity levels, such as low, medium, high, and critical, based on the base score." }, "configurations": { "type": "object", "properties": { "CVE_data_version": { "type": "string", "example": "string", "description": "Specifies the version of the CVE (Common Vulnerabilities and Exposures) dictionary used by the vulnerability information provider." }, "nodes": { "type": "array", "items": { "type": "object", "properties": { "operator": { "type": "string", "enum": [ "AND", "OR" ], "example": "AND", "description": "The operator string influences how seqs of cpe matches are related to one another." }, "cpe_match": { "type": "array", "items": { "type": "object", "properties": { "vulnerable": { "type": "boolean", "example": true }, "cpe23Uri": { "type": "string", "example": "string", "description": "A text representation of a software or hardware platform." }, "versionStartIncluding": { "type": "string", "example": "string", "description": "A string representing the lower bound(inclusive) of version in the CPE." }, "versionEndIncluding": { "type": "string", "example": "string", "description": "A string representing the upper bound(inclusive) of version in the CPE." }, "versionStartExcluding": { "type": "string", "example": "string", "description": "A string representing the lower bound(exclusive) of version in the CPE." }, "versionEndExcluding": { "type": "string", "example": "string", "description": "A string representing the upper bound(exclusive) of version in the CPE." } }, "required": [ "vulnerable", "cpe23Uri" ], "example": { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } }, "example": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ] }, "children": { "type": "array", "items": { "type": "object", "properties": { "operator": { "type": "string", "enum": [ "AND", "OR" ], "example": "AND", "description": "The operator string influences how seqs of cpe matches are related to one another." }, "cpe_match": { "type": "array", "items": { "type": "object", "properties": { "vulnerable": { "type": "boolean", "example": true }, "cpe23Uri": { "type": "string", "example": "string", "description": "A text representation of a software or hardware platform." }, "versionStartIncluding": { "type": "string", "example": "string", "description": "A string representing the lower bound(inclusive) of version in the CPE." }, "versionEndIncluding": { "type": "string", "example": "string", "description": "A string representing the upper bound(inclusive) of version in the CPE." }, "versionStartExcluding": { "type": "string", "example": "string", "description": "A string representing the lower bound(exclusive) of version in the CPE." }, "versionEndExcluding": { "type": "string", "example": "string", "description": "A string representing the upper bound(exclusive) of version in the CPE." } }, "required": [ "vulnerable", "cpe23Uri" ], "example": { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } }, "example": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ] }, "negate": { "type": "boolean", "example": true, "description": "Negates operator when true." } }, "required": [ "operator", "cpe_match" ], "example": { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "negate": true } }, "example": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "negate": true } ] }, "negate": { "type": "boolean", "example": true, "description": "Negates operator when true." } }, "required": [ "operator" ], "example": { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "children": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "negate": true } ], "negate": true } }, "example": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "children": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "negate": true } ], "negate": true } ], "description": "Each `node` in the CTIM standard configuration includes information such as the `operator` (such as \"less than\", or \"greater than or equal to\"), and the `cpe` (Common Platform Enumeration) string which identifies the specific software, `CPE` is a structured naming scheme for IT systems, platforms, and software packages, and it is instrumental in enabling data exchange between different systems." } }, "required": [ "CVE_data_version", "nodes" ], "example": { "CVE_data_version": "string", "nodes": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "children": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "negate": true } ], "negate": true } ] }, "description": "Represents a list of affected versions or configurations of a software component that is impacted by a vulnerability. \nBy tracking the affected software components and versions, defenders can identify which systems are potentially exposed to an attack, and apply appropriate mitigations." }, "published_date": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Represents the date when a vulnerability was publicly disclosed or made available to the general public. \n\nImportant for tracking the age of a vulnerability, as well as for determining when a particular vulnerability was first introduced into a system. The published date can be used to identify the time window during which a system may have been vulnerable to a particular exploit.\n\nFor example, if an organization discovers that a vulnerability was published before their system's installation date, but they did not apply the necessary security updates in a timely manner, it can be concluded that their system was vulnerable for the period between the installation date and the date when the necessary security updates were applied." }, "last_modified_date": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Represents the date when the vulnerability metadata was last updated in the internal database.\nIt can be used to track the freshness of the vulnerability information. If the `last_modified_date` is more recent than the `published_date`, it can indicate that there has been some new information or updates related to the vulnerability, such as new patch releases or changes in the severity or impact rating." } }, "required": [ "description" ], "example": { "description": "string", "schema_version": "1.3.30", "revision": 10, "published_date": "2016-01-01T01:01:01Z", "cve": { "cve_data_meta": { "id": "string", "assigner": "string" } }, "configurations": { "CVE_data_version": "string", "nodes": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "children": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "negate": true } ], "negate": true } ] }, "type": "vulnerability", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "last_modified_date": "2016-01-01T01:01:01Z", "impact": { "cvss_v2": { "integrity_impact": "complete", "target_distribution": "not_defined", "availability_requirement": "not_defined", "exploitability": "not_defined", "access_complexity": "low", "temporal_vector_string": "string", "exploitability_score": 10.0, "impact_score": 10.0, "user_interaction_required": true, "environmental_vector_string": "string", "obtain_other_privilege": true, "availability_impact": "complete", "access_vector": "network", "base_severity": "High", "confidentiality_impact": "complete", "confidentiality_requirement": "not_defined", "report_confidence": "not_defined", "authentication": "none", "base_score": 10.0, "obtain_user_privilege": true, "obtain_all_privilege": true, "collateral_damage_potential": "not_defined", "remediation_level": "not_defined", "vector_string": "string", "integrity_requirement": "not_defined" }, "cvss_v3": { "integrity_impact": "high", "modified_user_interaction": "none", "modified_scope": "not_defined", "availability_requirement": "high", "user_interaction": "none", "modified_integrity_impact": "not_defined", "privileges_required": "high", "exploitability_score": 10.0, "impact_score": 10.0, "environmental_severity": "critical", "modified_availability_impact": "not_defined", "availability_impact": "high", "scope": "changed", "exploit_code_maturity": "functional", "modified_attack_complexity": "not_defined", "base_severity": "critical", "confidentiality_impact": "high", "temporal_severity": "critical", "modified_confidentiality_impact": "not_defined", "confidentiality_requirement": "high", "report_confidence": "confirmed", "temporal_score": 10.0, "modified_privileges_required": "not_defined", "modified_attack_vector": "not_defined", "base_score": 10.0, "environmental_score": 10.0, "remediation_level": "high", "vector_string": "string", "integrity_requirement": "high", "attack_vector": "adjacent_network", "attack_complexity": "high" } } }, "description": "For submitting a new vulnerability." }, "uniqueItems": true, "example": [ { "description": "string", "schema_version": "1.3.30", "revision": 10, "published_date": "2016-01-01T01:01:01Z", "cve": { "cve_data_meta": { "id": "string", "assigner": "string" } }, "configurations": { "CVE_data_version": "string", "nodes": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "children": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "negate": true } ], "negate": true } ] }, "type": "vulnerability", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "last_modified_date": "2016-01-01T01:01:01Z", "impact": { "cvss_v2": { "integrity_impact": "complete", "target_distribution": "not_defined", "availability_requirement": "not_defined", "exploitability": "not_defined", "access_complexity": "low", "temporal_vector_string": "string", "exploitability_score": 10.0, "impact_score": 10.0, "user_interaction_required": true, "environmental_vector_string": "string", "obtain_other_privilege": true, "availability_impact": "complete", "access_vector": "network", "base_severity": "High", "confidentiality_impact": "complete", "confidentiality_requirement": "not_defined", "report_confidence": "not_defined", "authentication": "none", "base_score": 10.0, "obtain_user_privilege": true, "obtain_all_privilege": true, "collateral_damage_potential": "not_defined", "remediation_level": "not_defined", "vector_string": "string", "integrity_requirement": "not_defined" }, "cvss_v3": { "integrity_impact": "high", "modified_user_interaction": "none", "modified_scope": "not_defined", "availability_requirement": "high", "user_interaction": "none", "modified_integrity_impact": "not_defined", "privileges_required": "high", "exploitability_score": 10.0, "impact_score": 10.0, "environmental_severity": "critical", "modified_availability_impact": "not_defined", "availability_impact": "high", "scope": "changed", "exploit_code_maturity": "functional", "modified_attack_complexity": "not_defined", "base_severity": "critical", "confidentiality_impact": "high", "temporal_severity": "critical", "modified_confidentiality_impact": "not_defined", "confidentiality_requirement": "high", "report_confidence": "confirmed", "temporal_score": 10.0, "modified_privileges_required": "not_defined", "modified_attack_vector": "not_defined", "base_score": 10.0, "environmental_score": 10.0, "remediation_level": "high", "vector_string": "string", "integrity_requirement": "high", "attack_vector": "adjacent_network", "attack_complexity": "high" } } } ], "description": "a list of `NewVulnerability`s." }, "actor_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "asset_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "asset_mapping_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "asset_properties_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "attack_pattern_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "campaign_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "coa_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "feedback_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "identity_assertion_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "incident_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "indicator_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "judgement_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "malware_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "note_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "relationship_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "sighting_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "target_record_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "tool_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "verdict_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "data_table_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "weakness_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "vulnerability_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid." } }, "required": [ "source" ], "example": { "description": "string", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "asset_mapping_refs": [ "string" ], "note_refs": [ "string" ], "data_table_refs": [ "string" ], "attack_pattern_refs": [ "string" ], "sighting_refs": [ "string" ], "schema_version": "1.3.30", "revision": 10, "assets": [ { "description": "string", "asset_type": "application", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "type": "asset", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z" } ], "weakness_refs": [ "string" ], "tool_refs": [ "string" ], "target_record_refs": [ "string" ], "asset_refs": [ "string" ], "tools": [ { "description": "string", "labels": [ "credential-exploitation" ], "schema_version": "1.3.30", "revision": 10, "type": "tool", "x_mitre_aliases": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tool_version": "string", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "timestamp": "2016-01-01T01:01:01Z" } ], "indicators": [ { "description": "string", "tags": [ "string" ], "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "producer": "string", "schema_version": "1.3.30", "revision": 10, "type": "indicator", "test_mechanisms": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "composite_indicator_expression": { "operator": "and", "indicator_ids": [ "string" ] }, "title": "string", "likely_impact": "string", "indicator_type": [ "Anonymization" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "severity": "Critical", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "negate": true, "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "specification": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } } ], "attack_patterns": [ { "description": "string", "abstraction_level": "aggregate", "schema_version": "1.3.30", "revision": 10, "type": "attack-pattern", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "x_mitre_platforms": [ "string" ], "language": "string", "id": "string", "tlp": "green", "x_mitre_data_sources": [ "string" ], "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "x_mitre_contributors": [ "string" ], "timestamp": "2016-01-01T01:01:01Z" } ], "type": "bundle", "weaknesses": [ { "description": "string", "background_details": "string", "paradigms": [ { "prevalence": "Often", "name": "string" } ], "abstraction_level": "Base", "architectures": [ { "prevalence": "Often", "name": "string", "class": "Embedded" } ], "schema_version": "1.3.30", "revision": 10, "alternate_terms": [ { "term": "string", "description": "string" } ], "likelihood": "High", "type": "weakness", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "functional_areas": [ "Authentication" ], "source_uri": "string", "modes_of_introduction": [ { "phase": "Architecture and Design", "note": "string" } ], "structure": "Chain", "language": "string", "id": "string", "notes": [ { "type": "Applicable Platform", "note": "string" } ], "common_consequences": [ { "scopes": [ "Access Control" ], "impacts": [ "Alter Execution Logic" ], "likelihood": "High", "note": "string" } ], "tlp": "green", "detection_methods": [ { "method": "Architecture or Design Review", "description": "string", "effectiveness": "High", "effectiveness_notes": "string" } ], "operating_systems": [ { "prevalence": "Often", "name": "string", "version": "string", "cpe_id": "string", "class": "Android" } ], "affected_resources": [ "CPU" ], "languages": [ { "prevalence": "Often", "name": "string", "class": "Assembly" } ], "timestamp": "2016-01-01T01:01:01Z", "potential_mitigations": [ { "description": "string", "phases": [ "Architecture and Design" ], "strategy": "Attack Surface Reduction", "effectiveness": "Defense in Depth", "effectiveness_notes": "string" } ], "technologies": [ { "prevalence": "Often", "name": "string" } ] } ], "source": "string", "external_ids": [ "string" ], "feedback_refs": [ "string" ], "asset_properties": [ { "properties": [ { "name": "string", "value": "string" } ], "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "asset_ref": "string", "type": "asset-properties", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z" } ], "short_description": "string", "feedbacks": [ { "feedback": -1, "schema_version": "1.3.30", "revision": 10, "type": "feedback", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "reason": "string", "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "entity_id": "string", "timestamp": "2016-01-01T01:01:01Z" } ], "judgement_refs": [ "string" ], "title": "string", "coa_refs": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "verdicts": [ { "type": "verdict", "disposition": 1, "observable": { "value": "1.2.3.4", "type": "ip" }, "judgement_id": "string", "disposition_name": "Clean", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" } } ], "campaigns": [ { "description": "string", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "type": "campaign", "campaign_type": "string", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "activity": [ { "date_time": "2016-01-01T01:01:01Z", "description": "string" } ], "source_uri": "string", "intended_effect": [ "Account Takeover" ], "status": "Future", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "names": [ "string" ] } ], "source_uri": "string", "actors": [ { "description": "string", "motivation": "Ego", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "identity": { "description": "string", "related_identities": [ { "identity": "string", "confidence": "High", "information_source": "string", "relationship": "string" } ] }, "sophistication": "Aspirant", "schema_version": "1.3.30", "revision": 10, "planning_and_operational_support": "string", "type": "actor", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "intended_effect": "Account Takeover", "language": "string", "id": "string", "tlp": "green", "aliases": [ "string" ], "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "actor_types": [ "Cyber Espionage Operations" ] } ], "indicator_refs": [ "string" ], "actor_refs": [ "string" ], "language": "string", "data_tables": [ { "description": "string", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "columns": [ { "name": "string", "type": "integer", "description": "string", "required": true, "short_description": "string" } ], "type": "data-table", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "rows": [ [ "anything" ] ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "row_count": 10, "timestamp": "2016-01-01T01:01:01Z" } ], "id": "string", "notes": [ { "schema_version": "1.3.30", "revision": 10, "content": "string", "note_class": "keyword", "type": "note", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "author": "string", "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "related_entities": [ { "entity_type": "string", "entity_id": "string" } ] } ], "identity_assertions": [ { "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "identity": { "observables": [ { "value": "1.2.3.4", "type": "ip" } ] }, "schema_version": "1.3.30", "revision": 10, "type": "identity-assertion", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "assertions": [ { "name": "cisco:ctr:ad:host_domain_name", "value": "string" } ] } ], "judgements": [ { "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "observable": { "value": "1.2.3.4", "type": "ip" }, "reason_uri": "string", "type": "judgement", "source": "string", "external_ids": [ "string" ], "disposition": 1, "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "reason": "string", "source_uri": "string", "disposition_name": "Clean", "priority": 10, "language": "string", "id": "string", "severity": "Critical", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "confidence": "High" } ], "malwares": [ { "description": "string", "labels": [ "adware" ], "abstraction_level": "family", "schema_version": "1.3.30", "revision": 10, "type": "malware", "x_mitre_aliases": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "timestamp": "2016-01-01T01:01:01Z" } ], "target_records": [ { "description": "string", "schema_version": "1.3.30", "revision": 10, "type": "target-record", "source": "string", "external_ids": [ "string" ], "targets": [ { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "os": "string", "internal": false, "sensor": "string", "source_uri": "string" } ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z" } ], "asset_mappings": [ { "asset_type": "application", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "stability": "Managed", "schema_version": "1.3.30", "revision": 10, "observable": { "value": "1.2.3.4", "type": "ip" }, "asset_ref": "string", "type": "asset-mapping", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "specificity": "Low", "confidence": "High" } ], "relationship_refs": [ "string" ], "tlp": "green", "incidents": [ { "description": "string", "assignees": [ "string" ], "detection_sources": [ "string" ], "meta": { "keyword": "string" }, "schema_version": "1.3.30", "revision": 10, "type": "incident", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "incident_time": { "opened": "2016-01-01T01:01:01Z", "discovered": "2016-01-01T01:01:01Z", "reported": "2016-01-01T01:01:01Z", "remediated": "2016-01-01T01:01:01Z", "closed": "2016-01-01T01:01:01Z", "rejected": "2016-01-01T01:01:01Z", "contained": "2016-01-01T01:01:01Z" }, "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "discovery_method": "Agent Disclosure", "source_uri": "string", "intended_effect": "Account Takeover", "categories": [ "Attrition" ], "status": "Closed", "language": "string", "detection_status": "active", "id": "string", "promotion_method": "Automated", "severity": "Critical", "tlp": "green", "scores": { "asset": 10.0 }, "techniques": [ "string" ], "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "short_id": "string", "tactics": [ "string" ] } ], "identity_assertion_refs": [ "string" ], "sightings": [ { "description": "string", "schema_version": "1.3.30", "revision": 10, "relations": [ { "origin": "string", "origin_uri": "string", "relation": "Allocated", "relation_info": { "keyword": "anything" }, "source": { "value": "1.2.3.4", "type": "ip" }, "related": { "value": "1.2.3.4", "type": "ip" } } ], "sensor_coordinates": { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "os": "string" }, "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "type": "sighting", "source": "string", "external_ids": [ "string" ], "targets": [ { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "os": "string" } ], "short_description": "string", "title": "string", "resolution": "detected", "internal": false, "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "detection_interval": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "source_uri": "string", "activity_interval": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "language": "string", "id": "string", "count": 10, "severity": "Critical", "tlp": "green", "modification_interval": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "context": { "http_events": [ { "process_guid": 10, "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "method": "CONNECT", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "HTTPEvent", "host": "string", "process_name": "string", "process_id": 10, "process_username": "string", "query": "string", "encrypted": true, "url_port": 10 } ], "process_create_events": [ { "parent_process_name": "string", "process_guid": 10, "parent_process_guid": 10, "process_disposition": "string", "parent_process_size": 10, "process_size": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_disposition": "string", "type": "ProcessCreateEvent", "parent_process_username": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "parent_creation_time": "2016-01-01T01:01:01Z", "process_args": "string" } ], "registry_delete_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryDeleteEvent", "registry_value": "string" } ], "file_modify_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileModifyEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "registry_set_events": [ { "process_guid": 10, "registry_data": "string", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "RegistrySetEvent", "registry_data_length": 10, "registry_value": "string", "registry_key": "string", "process_name": "string", "process_id": 10, "process_username": "string" } ], "file_create_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileCreateEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "registry_create_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryCreateEvent" } ], "library_load_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "type": "LibraryLoadEvent", "dll_library_name": "string", "dll_library_path": "string" } ], "file_move_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileMoveEvent", "old_name": "string", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "new_name": "string" } ], "file_delete_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileDeleteEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "netflow_events": [ { "parent_process_name": "string", "byte_count_in": 10, "process_guid": 10, "process_path": "string", "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "flow_time": "2016-01-01T01:01:01Z", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_account": "string", "type": "NetflowEvent", "process_account_type": "string", "parent_process_path": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_account": "string", "parent_process_account_type": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "byte_count_out": 10, "process_args": "string" } ], "registry_rename_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryRenameEvent", "registry_old_key": "string" } ] }, "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "sensor": "endpoint", "data": { "columns": [ { "name": "string", "type": "integer", "description": "string", "required": true, "short_description": "string" } ], "rows": [ [ "anything" ] ], "row_count": 10 } } ], "campaign_refs": [ "string" ], "vulnerability_refs": [ "string" ], "asset_properties_refs": [ "string" ], "relationships": [ { "description": "string", "schema_version": "1.3.30", "revision": 10, "target_ref": "string", "type": "relationship", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "source_ref": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "relationship_type": "attributed-to" } ], "timestamp": "2016-01-01T01:01:01Z", "verdict_refs": [ "string" ], "malware_refs": [ "string" ], "incident_refs": [ "string" ], "vulnerabilities": [ { "description": "string", "schema_version": "1.3.30", "revision": 10, "published_date": "2016-01-01T01:01:01Z", "cve": { "cve_data_meta": { "id": "string", "assigner": "string" } }, "configurations": { "CVE_data_version": "string", "nodes": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "children": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "negate": true } ], "negate": true } ] }, "type": "vulnerability", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "last_modified_date": "2016-01-01T01:01:01Z", "impact": { "cvss_v2": { "integrity_impact": "complete", "target_distribution": "not_defined", "availability_requirement": "not_defined", "exploitability": "not_defined", "access_complexity": "low", "temporal_vector_string": "string", "exploitability_score": 10.0, "impact_score": 10.0, "user_interaction_required": true, "environmental_vector_string": "string", "obtain_other_privilege": true, "availability_impact": "complete", "access_vector": "network", "base_severity": "High", "confidentiality_impact": "complete", "confidentiality_requirement": "not_defined", "report_confidence": "not_defined", "authentication": "none", "base_score": 10.0, "obtain_user_privilege": true, "obtain_all_privilege": true, "collateral_damage_potential": "not_defined", "remediation_level": "not_defined", "vector_string": "string", "integrity_requirement": "not_defined" }, "cvss_v3": { "integrity_impact": "high", "modified_user_interaction": "none", "modified_scope": "not_defined", "availability_requirement": "high", "user_interaction": "none", "modified_integrity_impact": "not_defined", "privileges_required": "high", "exploitability_score": 10.0, "impact_score": 10.0, "environmental_severity": "critical", "modified_availability_impact": "not_defined", "availability_impact": "high", "scope": "changed", "exploit_code_maturity": "functional", "modified_attack_complexity": "not_defined", "base_severity": "critical", "confidentiality_impact": "high", "temporal_severity": "critical", "modified_confidentiality_impact": "not_defined", "confidentiality_requirement": "high", "report_confidence": "confirmed", "temporal_score": 10.0, "modified_privileges_required": "not_defined", "modified_attack_vector": "not_defined", "base_score": 10.0, "environmental_score": 10.0, "remediation_level": "high", "vector_string": "string", "integrity_requirement": "high", "attack_vector": "adjacent_network", "attack_complexity": "high" } } } ], "coas": [ { "description": "string", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "stage": "Containment", "schema_version": "1.3.30", "revision": 10, "efficacy": "High", "type": "coa", "related_COAs": [ { "confidence": "High", "source": "string", "relationship": "string", "COA_id": "string" } ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "coa_type": "Diplomatic Actions", "language": "string", "id": "string", "tlp": "green", "objective": [ "string" ], "cost": "High", "timestamp": "2016-01-01T01:01:01Z", "open_c2_coa": { "type": "structured_coa", "id": "string", "action": { "type": "alert" }, "target": { "type": "acudid", "specifiers": "string" }, "actuator": { "type": "endpoint", "specifiers": [ "string" ] }, "modifiers": { "response": "acknowledge", "method": [ "acl" ], "additional_properties": { "context": "string" }, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "frequency": "string", "duration": "2016-01-01T01:01:01Z", "source": "string", "search": "cve", "option": "string", "id": "string", "location": "internal", "delay": "2016-01-01T01:01:01Z", "destination": "copy-to" } }, "structured_coa_type": "openc2", "impact": "string" } ] }, "description": "Describes a Bundle of any set of CTIM entities." }, "investigated_observables": { "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." } }, "source": { "title": "InvestigationSource", "description": "String with at most 1024 characters.", "type": "string", "example": "Cisco XDR Automated Question" }, "title": { "title": "InvestigationTitle", "description": "String with at most 1024 characters.", "type": "string", "example": "Which devices in my org was this sha seen on?" }, "description": { "title": "InvestigationDescription", "description": "String with at most 5000 characters.", "type": "string", "example": "For the following hashes:\n- sha256:defg...1234\n- sha256:abcd..1234\n\nDetermine which devices in my org have instances of the file in the past 30 days" } }, "required": [ "bundle" ] } } ], "tags": [ "v2", "Investigation Creation" ], "summary": "Create Investigation from Snapshot", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/investigation/snapshot": { "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "investigation_id": { "type": "string", "format": "uuid" } }, "required": [ "investigation_id" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "additionalProperties": { "type": "string" }, "x-allOf": [ { "type": "object", "additionalProperties": { "type": "string" } }, { "type": "object", "properties": { "short_description": { "type": "string" }, "description": { "type": "string" }, "source": { "type": "string" }, "actions": { "type": "string" }, "timestamp": { "type": "string" } }, "required": [ "short_description", "source", "actions", "timestamp" ] } ] } } ], "tags": [ "v2", "Investigation Creation" ], "summary": "Create Investigation from Snapshot", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/investigation/{investigation-id}/snapshot": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "investigation_id": { "type": "string", "format": "uuid" } }, "required": [ "investigation_id" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "investigation-id", "description": "", "type": "string", "required": true } ], "tags": [ "v2", "Investigation Creation" ], "summary": "Create Investigation from Investigation Id", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/investigation/{investigation-id}/errors": { "get": { "responses": { "default": { "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "investigation-id", "description": "The investigation in scope", "type": "string", "required": true, "title": "InvestigationId", "format": "uuid", "default": "61399c06-5ea8-44ae-8256-cfcf4437ca5a" } ], "tags": [ "v2", "Investigation Data" ], "summary": "Investigation Errors", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/investigation/{investigation-id}/entities": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "investigation-id", "description": "The investigation in scope", "type": "string", "required": true, "title": "InvestigationId", "format": "uuid", "default": "61399c06-5ea8-44ae-8256-cfcf4437ca5a" } ], "tags": [ "v2", "Investigation Data" ], "summary": "Investigation Entities", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/investigation/{investigation-id}/events": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "events": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "id": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "observed_time": { "type": "object", "properties": { "start_time": { "type": "string" }, "end_time": { "type": "string", "x-nullable": true } }, "required": [ "start_time" ] }, "type": { "type": "string", "enum": [ "sighting" ] }, "context": { "x-nullable": true }, "data": { "type": "object", "properties": { "columns": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "type": { "type": "string", "enum": [ "integer", "markdown", "number", "observable", "string", "url" ] }, "description": { "type": "string", "x-nullable": true }, "required": { "type": "boolean" }, "short_description": { "type": "string", "x-nullable": true } }, "required": [ "name", "type" ] } }, "rows": { "type": "array", "items": {} }, "row_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "columns", "rows" ] }, "external_ids": { "type": "array", "items": { "type": "string" } }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "internal": { "type": "boolean" }, "language": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "resolution": { "type": "string", "enum": [ "allowed", "blocked", "contained", "detected" ] }, "sensor": { "type": "string" }, "sensor_coordinates": { "type": "object", "properties": { "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "os": { "type": "string" }, "type": { "type": "string" } }, "required": [ "observables", "type" ] }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "timestamp": { "type": "string" }, "compacted_entities": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, "compacted_relations": { "type": "array", "items": { "type": "object", "properties": { "source": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "related": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "relation": { "type": "string" }, "origin": { "type": "string" } }, "required": [ "source", "related", "relation" ] }, "uniqueItems": true }, "title": { "type": "string", "x-nullable": true }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "notability": { "type": "object", "properties": { "first_seen_target": { "type": "object", "properties": { "label": { "type": "string" }, "targets": { "type": "array", "items": {}, "uniqueItems": true } }, "required": [ "label", "targets" ] }, "severity": { "type": "object", "properties": { "label": { "type": "string" } }, "required": [ "label" ] }, "mitre-attack": { "type": "object", "properties": { "label": { "type": "string" } }, "required": [ "label" ] }, "first_seen_indicator": { "type": "object", "properties": { "label": { "type": "string" }, "indicators": { "type": "array", "items": {}, "uniqueItems": true } }, "required": [ "label", "indicators" ] }, "original_event": { "type": "object", "properties": { "label": { "type": "string" } }, "required": [ "label" ] } } }, "mitreData": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "enum": [ "TA0004", "TA0010", "TA0005", "TA0001", "TA0009", "TA0002", "TA0040", "TA0043", "TA0011", "TA0008", "TA0042", "TA0006", "TA0007", "TA0003" ] }, "value": { "type": "string", "enum": [ "TA0004", "TA0010", "TA0005", "TA0001", "TA0009", "TA0002", "TA0040", "TA0043", "TA0011", "TA0008", "TA0042", "TA0006", "TA0007", "TA0003" ] }, "phase_name": { "type": "string", "enum": [ "privilege-escalation", "exfiltration", "defense-evasion", "initial-access", "collection", "execution", "impact", "reconnaissance", "command-and-control", "lateral-movement", "resource-development", "credential-access", "discovery", "persistence" ] }, "priority": { "type": "integer", "enum": [ 6, 12, 7, 3, 10, 4, 13, 1, 11, 9, 2, 8, 8, 5 ] }, "url": { "type": "string", "enum": [ "https://attack.mitre.org/tactics/TA0004/", "https://attack.mitre.org/tactics/TA0010/", "https://attack.mitre.org/tactics/TA0005/", "https://attack.mitre.org/tactics/TA0001/", "https://attack.mitre.org/tactics/TA0009/", "https://attack.mitre.org/tactics/TA0002/", "https://attack.mitre.org/tactics/TA0040/", "https://attack.mitre.org/tactics/TA0043/", "https://attack.mitre.org/tactics/TA0011/", "https://attack.mitre.org/tactics/TA0008/", "https://attack.mitre.org/tactics/TA0042/", "https://attack.mitre.org/tactics/TA0006/", "https://attack.mitre.org/tactics/TA0007/", "https://attack.mitre.org/tactics/TA0003/" ] }, "title": { "type": "string", "enum": [ "Privilege Escalation", "Exfiltration", "Defense Evasion", "Initial Access", "Collection", "Execution", "Impact", "Reconnaissance", "Command and Control", "Lateral Movement", "Resource Development", "Credential Access", "Discovery", "Persistence" ] } }, "required": [ "id", "value", "phase_name", "priority", "url", "title" ] }, "uniqueItems": true }, "notable": { "type": "boolean" }, "original": { "type": "boolean" }, "indicators": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "indicator" ], "example": "indicator", "description": "The fixed value indicator" }, "schema_version": { "type": "string", "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "x-nullable": true, "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "x-nullable": true, "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "x-nullable": true, "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "x-nullable": true, "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "The time range during which this Indicator is considered valid." }, "producer": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "Critical" }, "negate": { "type": "boolean", "example": true, "description": "Specifies the absence of the pattern." }, "indicator_type": { "type": "array", "items": { "type": "string", "enum": [ "Anonymization", "C2", "Compromised PKI Certificate", "Domain Watchlist", "Exfiltration", "File Hash Watchlist", "Host Characteristics", "IMEI Watchlist", "IMSI Watchlist", "IP Watchlist", "Login Name", "Malicious E-mail", "Malware Artifacts", "Private Threat Feed", "URL Watchlist" ], "example": "Anonymization" }, "example": [ "Anonymization" ], "description": "Specifies the type or types for this Indicator." }, "tags": { "type": "array", "items": { "type": "string" }, "x-nullable": true, "example": [ "string" ], "description": "Descriptors for this indicator." }, "composite_indicator_expression": { "type": "object", "properties": { "operator": { "type": "string", "enum": [ "and", "not", "or" ], "example": "and" }, "indicator_ids": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an indicator." }, "example": [ "string" ] } }, "required": [ "operator", "indicator_ids" ], "example": { "operator": "and", "indicator_ids": [ "string" ] } }, "likely_impact": { "type": "string", "example": "string", "description": "Likely potential impact within the relevant context if this Indicator were to occur." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "level of confidence held in the accuracy of this Indicator." }, "kill_chain_phases": { "type": "array", "items": { "type": "object", "properties": { "kill_chain_name": { "type": "string", "example": "string", "description": "The name of the kill chain." }, "phase_name": { "type": "string", "example": "string", "description": "The name of the phase in the kill chain." } }, "required": [ "kill_chain_name", "phase_name" ], "example": { "kill_chain_name": "string", "phase_name": "string" }, "description": "The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives." }, "example": [ { "kill_chain_name": "string", "phase_name": "string" } ], "description": "Relevant kill chain phases indicated by this Indicator." }, "test_mechanisms": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "example": [ "string" ], "description": "Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator." }, "specification": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Judgement" ], "example": "Judgement" }, "judgements": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to a judgement." }, "example": [ "string" ] }, "required_judgements": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "source": { "type": "string", "example": "string" }, "relationship": { "type": "string", "example": "string" }, "judgement_id": { "type": "string", "example": "string", "description": "A URI leading to a judgement." } }, "required": [ "judgement_id" ], "example": { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } }, "example": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "required": [ "type", "judgements", "required_judgements" ], "example": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] }, "description": "An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.", "x-anyOf": [ { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Judgement" ], "example": "Judgement" }, "judgements": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to a judgement." }, "example": [ "string" ] }, "required_judgements": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "source": { "type": "string", "example": "string" }, "relationship": { "type": "string", "example": "string" }, "judgement_id": { "type": "string", "example": "string", "description": "A URI leading to a judgement." } }, "required": [ "judgement_id" ], "example": { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } }, "example": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "required": [ "type", "judgements", "required_judgements" ], "example": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] }, "description": "An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "ThreatBrain" ], "example": "ThreatBrain" }, "query": { "type": "string", "example": "string" }, "variables": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ] } }, "required": [ "type", "variables" ], "example": { "type": "ThreatBrain", "query": "string", "variables": [ "string" ] }, "description": "An indicator which runs in threatbrain..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Snort" ], "example": "Snort" }, "snort_sig": { "type": "string", "example": "string" } }, "required": [ "type", "snort_sig" ], "example": { "type": "Snort", "snort_sig": "string" }, "description": "An indicator which runs in snort..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "SIOC" ], "example": "SIOC" }, "SIOC": { "type": "string", "example": "string" } }, "required": [ "type", "SIOC" ], "example": { "type": "SIOC", "SIOC": "string" }, "description": "An indicator which runs in snort..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "OpenIOC" ], "example": "OpenIOC" }, "open_IOC": { "type": "string", "example": "string" } }, "required": [ "type", "open_IOC" ], "example": { "type": "OpenIOC", "open_IOC": "string" }, "description": "An indicator which contains an XML blob of an openIOC indicator." } ] }, "value": { "title": "Event.Indicator.Value", "type": "string", "example": "W32.AdditionVariableCommandObfuscation.ioc", "description": "The canonical label for an indicator." } }, "required": [ "id", "producer", "value" ], "example": { "description": "string", "tags": [ "string" ], "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "producer": "string", "schema_version": "1.3.30", "revision": 10, "type": "indicator", "test_mechanisms": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "composite_indicator_expression": { "operator": "and", "indicator_ids": [ "string" ] }, "title": "string", "likely_impact": "string", "indicator_type": [ "Anonymization" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "severity": "Critical", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "negate": true, "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "specification": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "description": "An indicator is a test, or a collection of judgements that define\ncriteria for identifying the activity, or presence of malware, or\nother unwanted software.\n\nWe follow the\n[STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/)\nclosely, with the exception of not including observables within the\nindicator, and preferring a _specification_ object encoded in JSON as\nopposed to an opaque _implementation_ block.\n\nAdditional, you will want to either define judgements against\nObservables that are linked to this indicator, with the ID in the\n_indicators_ field of those Judgements, or you can provide a\n_specification_ value." } }, "investigationId": { "type": "string", "x-nullable": true }, "investigationShortDescription": { "type": "string", "x-nullable": true }, "investigationSource": { "type": "string", "x-nullable": true }, "targets": { "type": "array", "items": { "type": "object", "properties": { "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "type": { "title": "TargetTypeEnum", "type": "string", "enum": [ "device", "person", "user", "email", "endpoint.sensor", "process.network-scanner", "network.switch", "network.security_manager", "process.vulnerability-scanner", "network.hub", "network.ids", "network.firewall", "process", "network.sense_making", "process.sandbox", "network.modem", "process.email-service", "process.dns-server", "network.vpn", "process.connection-scanner", "network.nic", "endpoint.printer", "network.gateway", "process.reputation-service", "process.remediation-service", "network", "process.virtualization-service", "network.ips", "endpoint.smart-meter", "endpoint.digital-telephone-handset", "endpoint.workstation", "endpoint.server", "network.wap", "endpoint.laptop", "process.aaa-server", "process.directory-service", "endpoint.pos-terminal", "network.bridge", "process.file-scanner", "network.proxy", "endpoint", "process.location-service", "network.sensor", "endpoint.smart-phone", "network.hips", "process.anti-virus-scanner", "endpoint.tablet", "network.guard", "network.router" ], "example": "endpoint", "description": "The targe type/actuator that best fits the device." }, "value": { "title": "TargetSummary.Value", "type": "string", "example": "CARGO-Example", "description": "The targe type/actuator that best fits the device." }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The numerical value of the Device. Will Default to 10 if the Target is resolved.", "example": 2, "x-nullable": true, "default": 7 }, "is_asset": { "title": "TargetSummary.IsAssetEnum", "enum": [ true ], "type": "boolean", "example": true, "description": "Always true for targets." }, "observableType": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The observable type of the defining target observable" }, "observables": { "title": "TargetSummary.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true, "description": "The observable type of the defining target observable" }, "asset_id": { "title": "TargetSummary.AssetId", "type": "string", "example": "4911bbf5-aa42-463b-9a47-65f24140cfe4", "description": "The Device/User Insights ID of this Person or Device.", "x-nullable": true }, "properties": { "title": "TargetSummary.Properties", "type": "array", "items": { "type": "object", "properties": { "name": { "title": "Property.Name", "type": "string", "description": "An open vocabulary string that describes the name of the property.", "example": "cisco:ctr:labels" }, "value": { "title": "Property.Value", "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": {} } ], "description": "The value of the named property.", "example": [ "example label", 1, [ "it can be a string or an int or a vector of anything" ] ] } }, "required": [ "name", "value" ] }, "uniqueItems": true, "description": "The List of Device or Person properties for this resolved Person/Device." } }, "required": [ "type", "value", "is_asset", "observableType", "observables", "asset_id", "properties" ] } }, "relations": { "type": "array", "items": { "type": "object", "properties": { "origin": { "type": "string" }, "relation": { "type": "string" }, "related": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ], "x-anyOf": [ { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ] }, { "type": "object", "properties": { "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "type": { "title": "TargetTypeEnum", "type": "string", "enum": [ "device", "person", "user", "email", "endpoint.sensor", "process.network-scanner", "network.switch", "network.security_manager", "process.vulnerability-scanner", "network.hub", "network.ids", "network.firewall", "process", "network.sense_making", "process.sandbox", "network.modem", "process.email-service", "process.dns-server", "network.vpn", "process.connection-scanner", "network.nic", "endpoint.printer", "network.gateway", "process.reputation-service", "process.remediation-service", "network", "process.virtualization-service", "network.ips", "endpoint.smart-meter", "endpoint.digital-telephone-handset", "endpoint.workstation", "endpoint.server", "network.wap", "endpoint.laptop", "process.aaa-server", "process.directory-service", "endpoint.pos-terminal", "network.bridge", "process.file-scanner", "network.proxy", "endpoint", "process.location-service", "network.sensor", "endpoint.smart-phone", "network.hips", "process.anti-virus-scanner", "endpoint.tablet", "network.guard", "network.router" ], "example": "endpoint", "description": "The targe type/actuator that best fits the device." }, "value": { "title": "TargetSummary.Value", "type": "string", "example": "CARGO-Example", "description": "The targe type/actuator that best fits the device." }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The numerical value of the Device. Will Default to 10 if the Target is resolved.", "example": 2, "x-nullable": true, "default": 7 }, "is_asset": { "title": "TargetSummary.IsAssetEnum", "enum": [ true ], "type": "boolean", "example": true, "description": "Always true for targets." }, "observableType": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The observable type of the defining target observable" }, "observables": { "title": "TargetSummary.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true, "description": "The observable type of the defining target observable" }, "asset_id": { "title": "TargetSummary.AssetId", "type": "string", "example": "4911bbf5-aa42-463b-9a47-65f24140cfe4", "description": "The Device/User Insights ID of this Person or Device.", "x-nullable": true }, "properties": { "title": "TargetSummary.Properties", "type": "array", "items": { "type": "object", "properties": { "name": { "title": "Property.Name", "type": "string", "description": "An open vocabulary string that describes the name of the property.", "example": "cisco:ctr:labels" }, "value": { "title": "Property.Value", "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": {} } ], "description": "The value of the named property.", "example": [ "example label", 1, [ "it can be a string or an int or a vector of anything" ] ] } }, "required": [ "name", "value" ] }, "uniqueItems": true, "description": "The List of Device or Person properties for this resolved Person/Device." } }, "required": [ "type", "value", "is_asset", "observableType", "observables", "asset_id", "properties" ] } ] }, "source": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ], "x-anyOf": [ { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ] }, { "type": "object", "properties": { "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "type": { "title": "TargetTypeEnum", "type": "string", "enum": [ "device", "person", "user", "email", "endpoint.sensor", "process.network-scanner", "network.switch", "network.security_manager", "process.vulnerability-scanner", "network.hub", "network.ids", "network.firewall", "process", "network.sense_making", "process.sandbox", "network.modem", "process.email-service", "process.dns-server", "network.vpn", "process.connection-scanner", "network.nic", "endpoint.printer", "network.gateway", "process.reputation-service", "process.remediation-service", "network", "process.virtualization-service", "network.ips", "endpoint.smart-meter", "endpoint.digital-telephone-handset", "endpoint.workstation", "endpoint.server", "network.wap", "endpoint.laptop", "process.aaa-server", "process.directory-service", "endpoint.pos-terminal", "network.bridge", "process.file-scanner", "network.proxy", "endpoint", "process.location-service", "network.sensor", "endpoint.smart-phone", "network.hips", "process.anti-virus-scanner", "endpoint.tablet", "network.guard", "network.router" ], "example": "endpoint", "description": "The targe type/actuator that best fits the device." }, "value": { "title": "TargetSummary.Value", "type": "string", "example": "CARGO-Example", "description": "The targe type/actuator that best fits the device." }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The numerical value of the Device. Will Default to 10 if the Target is resolved.", "example": 2, "x-nullable": true, "default": 7 }, "is_asset": { "title": "TargetSummary.IsAssetEnum", "enum": [ true ], "type": "boolean", "example": true, "description": "Always true for targets." }, "observableType": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The observable type of the defining target observable" }, "observables": { "title": "TargetSummary.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true, "description": "The observable type of the defining target observable" }, "asset_id": { "title": "TargetSummary.AssetId", "type": "string", "example": "4911bbf5-aa42-463b-9a47-65f24140cfe4", "description": "The Device/User Insights ID of this Person or Device.", "x-nullable": true }, "properties": { "title": "TargetSummary.Properties", "type": "array", "items": { "type": "object", "properties": { "name": { "title": "Property.Name", "type": "string", "description": "An open vocabulary string that describes the name of the property.", "example": "cisco:ctr:labels" }, "value": { "title": "Property.Value", "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": {} } ], "description": "The value of the named property.", "example": [ "example label", 1, [ "it can be a string or an int or a vector of anything" ] ] } }, "required": [ "name", "value" ] }, "uniqueItems": true, "description": "The List of Device or Person properties for this resolved Person/Device." } }, "required": [ "type", "value", "is_asset", "observableType", "observables", "asset_id", "properties" ] } ] }, "origin_uri": { "type": "string" }, "relation_info": {} }, "required": [ "origin", "relation", "related", "source" ] } }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ] } }, "tactics_and_techniques": { "type": "array", "items": { "title": "Mitre tactics and Techniques", "type": "object", "properties": { "id": { "title": "MitreID", "type": "string", "example": "TA0003", "description": "MITRE ATT&CK ID" }, "external_id": { "title": "MitreExternalId", "type": "string", "example": "TA0003", "description": "MITRE ATT&CK ID" }, "title": { "title": "MitreTitle", "type": "string", "example": "Persistence" }, "short_description": { "title": "MitreShortDescription", "type": "string", "x-nullable": true, "example": "Persistence" }, "description": { "title": "MitreDescription", "type": "string", "example": "The adversary is trying to maintain their foothold.\n\nPersistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code." }, "score": { "title": "MitreScore", "type": "integer", "format": "int64", "minimum": 1, "maximum": 1000, "x-nullable": true, "example": 44 }, "source_url": { "title": "MitreSourceURL", "type": "string", "x-nullable": true, "example": "https://attack.mitre.org/techniques/TA0003", "description": "The source url for this tactic or technique" }, "mitre_type": { "type": "string", "enum": [ "tactic", "technique", "subtechnique" ] } }, "required": [ "id", "external_id", "title", "short_description", "description", "score", "source_url", "mitre_type" ], "description": "A MITRE object from https://attack.mitre.org/" } } }, "required": [ "confidence", "count", "id", "observed_time", "type", "notable", "original", "targets", "relations", "observables" ] } } }, "required": [ "events" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "investigation-id", "description": "The investigation in scope", "type": "string", "required": true, "title": "InvestigationId", "format": "uuid", "default": "61399c06-5ea8-44ae-8256-cfcf4437ca5a" }, { "description": "A integer greater than 0.", "format": "int64", "name": "limit", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "description": "A integer greater than 0.", "format": "int64", "name": "offset", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "in": "query", "name": "sort", "description": "", "type": "string", "required": false, "enum": [ "asc", "desc" ], "allowEmptyValue": true }, { "in": "query", "name": "order", "description": "", "type": "string", "required": false, "enum": [ "start_time", "time", "title", "severity", "source" ], "allowEmptyValue": true }, { "in": "query", "name": "important_only", "description": "Include only important events", "type": "boolean", "required": false }, { "in": "query", "name": "notable", "description": "", "type": "boolean", "required": false }, { "in": "query", "name": "source", "description": "", "type": "array", "required": false, "items": { "type": "string" }, "x-anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "string", "allowEmptyValue": true } ] }, { "in": "query", "name": "severity", "description": "", "type": "array", "required": false, "items": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "x-anyOf": [ { "type": "array", "items": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] } }, { "type": "string", "allowEmptyValue": true } ] }, { "in": "query", "name": "type", "description": "", "type": "array", "required": false, "items": { "type": "string", "enum": [ "Original", "Investigated" ] }, "x-anyOf": [ { "type": "array", "items": { "type": "string", "enum": [ "Original", "Investigated" ] } }, { "type": "string", "allowEmptyValue": true } ] }, { "in": "query", "name": "search_text", "description": "", "type": "string", "required": false } ], "tags": [ "v2", "Investigation Data" ], "summary": "Investigation Events", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/investigation/{investigation-id}/verdicts": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "observable": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "end_time": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" }, {} ] } }, "required": [ "start_time", "end_time" ] }, "disposition": { "type": "integer", "format": "int64" }, "judgement_ids": { "type": "array", "items": { "type": "string", "format": "uuid", "x-anyOf": [ { "type": "string", "format": "uuid" }, { "type": "string" } ] }, "x-nullable": true }, "module": { "type": "string" }, "module_instance_id": { "type": "string", "format": "uuid", "x-anyOf": [ { "type": "string", "format": "uuid" }, { "type": "string" } ] }, "module_type_id": { "type": "string", "format": "uuid", "x-anyOf": [ { "type": "string", "format": "uuid" }, { "type": "string" } ] } }, "required": [ "type", "observable", "valid_time", "disposition", "judgement_ids", "module", "module_instance_id", "module_type_id" ] } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "investigation-id", "description": "The investigation in scope", "type": "string", "required": true, "title": "InvestigationId", "format": "uuid", "default": "61399c06-5ea8-44ae-8256-cfcf4437ca5a" } ], "tags": [ "v2", "Investigation Data" ], "summary": "Investigation Verdicts", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/investigation/{investigation-id}/graph": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "nodes": { "type": "object", "additionalProperties": { "type": "object", "properties": { "data": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "asset_id": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "indicators": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "internal": { "type": "boolean" }, "incoming-edges": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "value": { "type": "string" } }, "required": [ "id", "value" ] }, "uniqueItems": true }, "outgoing-edges": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "value": { "type": "string" } }, "required": [ "id", "value" ] }, "uniqueItems": true }, "investigated": { "type": "boolean" }, "is_asset": { "type": "boolean" }, "observableType": { "type": "string" }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" } }, "required": [ "type", "value", "disposition", "investigated" ] } }, "properties": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": {} }, "required": [ "name", "value" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": {} }, "required": [ "name", "value" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": {} }, "required": [ "name", "value" ] } } ] }, "modules": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "title": { "type": "string" }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." } }, "required": [ "type", "value", "indicators", "internal", "incoming-edges", "outgoing-edges", "investigated", "is_asset", "observableType", "observables", "modules", "sightings", "sources", "title" ] }, "times": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "integer", "format": "int64" } }, "required": [ "time" ] }, "uniqueItems": true } }, "required": [ "data", "times" ] } }, "edges": { "type": "object", "additionalProperties": { "type": "object", "properties": { "id1": { "type": "string" }, "id2": { "type": "string" }, "times": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "integer", "format": "int64" } }, "required": [ "time" ] }, "uniqueItems": true }, "data": { "type": "object", "properties": { "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "value": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "relation_info": {} }, "required": [ "value", "sightings" ] } }, "required": [ "id1", "id2", "times", "data" ] } }, "errors": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "E_DATA_TOO_LARGE" ] }, "message": { "type": "string" } }, "required": [ "type", "message" ] } } }, "required": [ "nodes", "edges" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "investigation-id", "description": "The investigation in scope", "type": "string", "required": true, "title": "InvestigationId", "format": "uuid", "default": "61399c06-5ea8-44ae-8256-cfcf4437ca5a" } ], "tags": [ "v2", "Investigation Data" ], "summary": "Investigation Relation Graph", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/investigation/{investigation-id}/indicators": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "producer": { "type": "string" }, "description": { "type": "string", "x-nullable": true }, "short_description": { "type": "string", "x-nullable": true }, "internal": { "type": "boolean" }, "source": { "type": "string", "x-nullable": true }, "source_uri": { "type": "string", "x-nullable": true }, "sources": { "type": "array", "items": { "type": "string" } }, "tags": { "type": "array", "items": { "type": "string" }, "x-nullable": true }, "title": { "type": "string", "x-nullable": true }, "value": { "type": "string" } }, "required": [ "id", "producer", "description", "short_description", "internal", "source", "source_uri", "sources", "tags", "title", "value" ] } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "investigation-id", "description": "The investigation in scope", "type": "string", "required": true, "title": "InvestigationId", "format": "uuid", "default": "61399c06-5ea8-44ae-8256-cfcf4437ca5a" } ], "tags": [ "v2", "Investigation Data" ], "summary": "Returns a list of indicators attached to this investigation", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/investigation/{investigation-id}/observables": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated", "count" ] } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "investigation-id", "description": "The investigation in scope", "type": "string", "required": true, "title": "InvestigationId", "format": "uuid", "default": "61399c06-5ea8-44ae-8256-cfcf4437ca5a" } ], "tags": [ "v2", "Investigation Data" ], "summary": "Returns a list of observables attached to this investigation", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/investigation/{investigation-id}/overview": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "created_at": { "type": "string", "format": "date-time" }, "description": { "type": "string", "x-nullable": true }, "short_description": { "type": "string", "x-nullable": true }, "saved": { "type": "boolean" }, "saved_at": { "type": "string", "format": "date-time", "x-nullable": true }, "investigated_observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "title": { "type": "string" } }, "required": [ "id", "created_at", "description", "short_description", "saved", "saved_at", "investigated_observables", "title" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "investigation-id", "description": "The investigation in scope", "type": "string", "required": true, "title": "InvestigationId", "format": "uuid", "default": "61399c06-5ea8-44ae-8256-cfcf4437ca5a" } ], "tags": [ "v2", "Investigation Data" ], "summary": "Returns metadata about the investigation", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/investigation/{investigation-id}/status": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "title": "Investigation.Status", "description": "Details about Investigation Processing.", "type": "object", "properties": { "investigation_id": { "title": "Investigation.Status.InvestigationId", "description": "The ID of this investigation", "type": "string", "format": "uuid", "example": "d384c7c9-36b8-4781-b8a4-e7b0fe2ff0f3" }, "completed": { "title": "PositiveInteger", "description": "A integer greater than 0.", "type": "integer", "format": "int64", "minimum": 0, "example": 1 }, "pending": { "title": "PositiveInteger", "description": "A integer greater than 0.", "type": "integer", "format": "int64", "minimum": 0, "example": 0 }, "sightings": { "title": "PositiveInteger", "description": "A integer greater than 0.", "type": "integer", "format": "int64", "minimum": 0, "example": 1 }, "indicators": { "title": "PositiveInteger", "description": "A integer greater than 0.", "type": "integer", "format": "int64", "minimum": 0, "example": 2 }, "verdicts": { "title": "PositiveInteger", "description": "A integer greater than 0.", "type": "integer", "format": "int64", "minimum": 0, "example": 10 } }, "required": [ "investigation_id", "completed", "pending", "sightings", "indicators", "verdicts" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "investigation-id", "description": "The investigation in scope", "type": "string", "required": true, "title": "InvestigationId", "format": "uuid", "default": "61399c06-5ea8-44ae-8256-cfcf4437ca5a" } ], "tags": [ "v2", "Investigation Data" ], "summary": "Investigation Status", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/investigation/{investigation-id}/summary": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "event_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "last_seen_event": { "type": "string", "format": "date-time", "x-nullable": true }, "first_seen_event": { "type": "string", "format": "date-time", "x-nullable": true }, "sources": { "type": "array", "items": { "type": "string" } }, "indicators": { "type": "object", "properties": { "total_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "producer": { "type": "string" }, "description": { "type": "string", "x-nullable": true }, "short_description": { "type": "string", "x-nullable": true }, "internal": { "type": "boolean" }, "source": { "type": "string", "x-nullable": true }, "source_uri": { "type": "string", "x-nullable": true }, "sources": { "type": "array", "items": { "type": "string" } }, "tags": { "type": "array", "items": { "type": "string" }, "x-nullable": true }, "title": { "type": "string", "x-nullable": true }, "value": { "type": "string" }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "id", "producer", "description", "short_description", "internal", "source", "source_uri", "sources", "tags", "title", "value", "count" ] } } }, "required": [ "total_count", "data" ] }, "observables": { "type": "object", "properties": { "total_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated", "count" ] } } }, "required": [ "total_count", "data" ] }, "targets": { "type": "object", "properties": { "total_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "type": { "title": "TargetTypeEnum", "type": "string", "enum": [ "device", "person", "user", "email", "endpoint.sensor", "process.network-scanner", "network.switch", "network.security_manager", "process.vulnerability-scanner", "network.hub", "network.ids", "network.firewall", "process", "network.sense_making", "process.sandbox", "network.modem", "process.email-service", "process.dns-server", "network.vpn", "process.connection-scanner", "network.nic", "endpoint.printer", "network.gateway", "process.reputation-service", "process.remediation-service", "network", "process.virtualization-service", "network.ips", "endpoint.smart-meter", "endpoint.digital-telephone-handset", "endpoint.workstation", "endpoint.server", "network.wap", "endpoint.laptop", "process.aaa-server", "process.directory-service", "endpoint.pos-terminal", "network.bridge", "process.file-scanner", "network.proxy", "endpoint", "process.location-service", "network.sensor", "endpoint.smart-phone", "network.hips", "process.anti-virus-scanner", "endpoint.tablet", "network.guard", "network.router" ], "example": "endpoint", "description": "The targe type/actuator that best fits the device." }, "value": { "title": "TargetSummary.Value", "type": "string", "example": "CARGO-Example", "description": "The targe type/actuator that best fits the device." }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The numerical value of the Device. Will Default to 10 if the Target is resolved.", "example": 2, "x-nullable": true, "default": 7 }, "is_asset": { "title": "TargetSummary.IsAssetEnum", "enum": [ true ], "type": "boolean", "example": true, "description": "Always true for targets." }, "observableType": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The observable type of the defining target observable" }, "observables": { "title": "TargetSummary.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true, "description": "The observable type of the defining target observable" }, "asset_id": { "title": "TargetSummary.AssetId", "type": "string", "example": "4911bbf5-aa42-463b-9a47-65f24140cfe4", "description": "The Device/User Insights ID of this Person or Device.", "x-nullable": true }, "properties": { "title": "TargetSummary.Properties", "type": "array", "items": { "type": "object", "properties": { "name": { "title": "Property.Name", "type": "string", "description": "An open vocabulary string that describes the name of the property.", "example": "cisco:ctr:labels" }, "value": { "title": "Property.Value", "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": {} } ], "description": "The value of the named property.", "example": [ "example label", 1, [ "it can be a string or an int or a vector of anything" ] ] } }, "required": [ "name", "value" ] }, "uniqueItems": true, "description": "The List of Device or Person properties for this resolved Person/Device." }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "type", "value", "is_asset", "observableType", "observables", "asset_id", "properties", "count" ] } } }, "required": [ "total_count", "data" ] }, "investigation": { "type": "object", "properties": { "id": { "type": "string" }, "created_at": { "type": "string" }, "description": { "type": "string", "x-nullable": true }, "short_description": { "type": "string", "x-nullable": true }, "saved": { "type": "boolean" }, "saved_at": { "type": "string", "x-nullable": true }, "investigated_observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "title": { "type": "string" } }, "required": [ "id", "created_at", "description", "short_description", "saved", "saved_at", "investigated_observables", "title" ] } }, "required": [ "event_count", "last_seen_event", "first_seen_event", "sources", "indicators", "observables", "targets", "investigation" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "investigation-id", "description": "The investigation in scope", "type": "string", "required": true, "title": "InvestigationId", "format": "uuid", "default": "61399c06-5ea8-44ae-8256-cfcf4437ca5a" } ], "tags": [ "v2", "Investigation Data" ], "summary": "Returns a Summary of the Investigation", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/investigation/{investigation-id}/targets": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": { "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "type": { "title": "TargetTypeEnum", "type": "string", "enum": [ "device", "person", "user", "email", "endpoint.sensor", "process.network-scanner", "network.switch", "network.security_manager", "process.vulnerability-scanner", "network.hub", "network.ids", "network.firewall", "process", "network.sense_making", "process.sandbox", "network.modem", "process.email-service", "process.dns-server", "network.vpn", "process.connection-scanner", "network.nic", "endpoint.printer", "network.gateway", "process.reputation-service", "process.remediation-service", "network", "process.virtualization-service", "network.ips", "endpoint.smart-meter", "endpoint.digital-telephone-handset", "endpoint.workstation", "endpoint.server", "network.wap", "endpoint.laptop", "process.aaa-server", "process.directory-service", "endpoint.pos-terminal", "network.bridge", "process.file-scanner", "network.proxy", "endpoint", "process.location-service", "network.sensor", "endpoint.smart-phone", "network.hips", "process.anti-virus-scanner", "endpoint.tablet", "network.guard", "network.router" ], "example": "endpoint", "description": "The targe type/actuator that best fits the device." }, "value": { "title": "TargetSummary.Value", "type": "string", "example": "CARGO-Example", "description": "The targe type/actuator that best fits the device." }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The numerical value of the Device. Will Default to 10 if the Target is resolved.", "example": 2, "x-nullable": true, "default": 7 }, "is_asset": { "title": "TargetSummary.IsAssetEnum", "enum": [ true ], "type": "boolean", "example": true, "description": "Always true for targets." }, "observableType": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The observable type of the defining target observable" }, "observables": { "title": "TargetSummary.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true, "description": "The observable type of the defining target observable" }, "asset_id": { "title": "TargetSummary.AssetId", "type": "string", "example": "4911bbf5-aa42-463b-9a47-65f24140cfe4", "description": "The Device/User Insights ID of this Person or Device.", "x-nullable": true }, "properties": { "title": "TargetSummary.Properties", "type": "array", "items": { "type": "object", "properties": { "name": { "title": "Property.Name", "type": "string", "description": "An open vocabulary string that describes the name of the property.", "example": "cisco:ctr:labels" }, "value": { "title": "Property.Value", "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": {} } ], "description": "The value of the named property.", "example": [ "example label", 1, [ "it can be a string or an int or a vector of anything" ] ] } }, "required": [ "name", "value" ] }, "uniqueItems": true, "description": "The List of Device or Person properties for this resolved Person/Device." }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "type", "value", "is_asset", "observableType", "observables", "asset_id", "properties", "count" ] } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "investigation-id", "description": "The investigation in scope", "type": "string", "required": true, "title": "InvestigationId", "format": "uuid", "default": "61399c06-5ea8-44ae-8256-cfcf4437ca5a" } ], "tags": [ "v2", "Investigation Data" ], "summary": "Returns a list of targets attached to this investigation", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/investigation/{investigation-id}/bundle": { "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "investigation_id": { "type": "string", "format": "uuid" }, "created_threat_object_counts": { "type": "object", "properties": { "sightings": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "indicators": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "verdicts": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "judgements": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "malwares": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "tools": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "attack_patterns": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "assets": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "sightings", "indicators", "verdicts", "judgements", "malwares", "tools", "attack_patterns", "assets" ] } }, "required": [ "investigation_id", "created_threat_object_counts" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "investigation-id", "description": "The investigation in scope", "type": "string", "required": true, "title": "InvestigationId", "format": "uuid", "default": "61399c06-5ea8-44ae-8256-cfcf4437ca5a" }, { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "bundle": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "bundle" ], "example": "bundle", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "actors": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "actor" ], "example": "actor", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Indicates the time span for which the information about the Actor is relevant, and after which it could become outdated." }, "actor_types": { "type": "array", "items": { "type": "string", "example": "Cyber Espionage Operations" }, "example": [ "Cyber Espionage Operations" ] }, "identity": { "type": "object", "properties": { "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "related_identities": { "type": "array", "items": { "type": "object", "properties": { "identity": { "type": "string", "example": "string", "description": "The reference (URI) of the related Identity object." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "Specifies the level of confidence in the assertion of the relationship between the two objects." }, "information_source": { "type": "string", "example": "string", "description": "Specifies the source of the information about the relationship between the two components." }, "relationship": { "type": "string", "example": "string" } }, "required": [ "identity" ], "example": { "identity": "string", "confidence": "High", "information_source": "string", "relationship": "string" }, "description": "Describes a related Identity" }, "example": [ { "identity": "string", "confidence": "High", "information_source": "string", "relationship": "string" } ], "description": "Identifies other entity Identities related to this Identity." } }, "required": [ "description", "related_identities" ], "example": { "description": "string", "related_identities": [ { "identity": "string", "confidence": "High", "information_source": "string", "relationship": "string" } ] }, "description": "Can contain information such as the name of the attacker, the group or organization they belong to, or any other identifier that can help in the attribution process." }, "motivation": { "type": "string", "example": "Ego", "description": "The reason or purpose behind the malicious activity attributed to this Actor. By understanding a threat actor's motivation, analysts can better predict the attacker's behavior and anticipate future malicious actions." }, "sophistication": { "type": "string", "enum": [ "Aspirant", "Expert", "Innovator", "Novice", "Practitioner" ], "example": "Aspirant", "description": "Represents the level of expertise and skill that the threat actor has displayed in their malicious activities. Can help security analysts assess the potential impact of an attacker's TTPs and determine the potential attack surface. \n\nFor example, a threat actor with a low sophistication level may primarily rely on off-the-shelf malware and attack tools, while an attacker with high sophistication may use custom tools with advanced evasion techniques, zero-day exploits, and sophisticated methods for command and control of their malware. \n\nThe sophistication level of an attacker can also be inferred based on several factors such as the complexity of attacks, the attacker's knowledge of the targeted organization's systems, and the attacker's ability to remain undetected.\n\nIf an attacker shows a high level of sophistication in reconnaissances, social engineering, and phishing, then the attacker may have a good knowledge of the targeted organization and its employees. This means that the attacker may be more successful in infiltrating the organization's network and compromising its systems." }, "intended_effect": { "type": "string", "example": "Account Takeover", "description": "Represents the desired outcome or impact the threat actor is trying to achieve through their malicious activities. \n\n Helps security analysts to understand the attacker's goals beyond the immediate impact of the attack. By understanding the intended effect, analysts can draw connections between seemingly unrelated attacks and build a more complete understanding of an attacker's long-term goals and motivations." }, "planning_and_operational_support": { "type": "string", "example": "string", "description": "Provides information about the resources and capabilities of the attacker that could be used to assist in planning and operations related to the threat.\n\n It can be used to describe Infrastructure, Tools, Techniques, and Capabilities used by the threat actor." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "This field can help analysts decide how much trust they can put in the information provided by the threat intelligence sources.\n\nFor example, an Actor entity can have high confidence if the organization's security researchers have been tracking it for a long time and have gathered a significant amount of intelligence about it through various sources, such as analysis of malware, network traffic, and human intelligence. In contrast, low confidence may indicate the organization has only seen limited or circumstantial evidence." }, "aliases": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "A list of other names that this Threat Actor is believed to use." } }, "required": [ "source", "title", "description", "short_description" ], "example": { "description": "string", "motivation": "Ego", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "identity": { "description": "string", "related_identities": [ { "identity": "string", "confidence": "High", "information_source": "string", "relationship": "string" } ] }, "sophistication": "Aspirant", "schema_version": "1.3.30", "revision": 10, "planning_and_operational_support": "string", "type": "actor", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "intended_effect": "Account Takeover", "language": "string", "id": "string", "tlp": "green", "aliases": [ "string" ], "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "actor_types": [ "Cyber Espionage Operations" ] }, "description": "Schema for submitting new Actors" }, "uniqueItems": true, "example": [ { "description": "string", "motivation": "Ego", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "identity": { "description": "string", "related_identities": [ { "identity": "string", "confidence": "High", "information_source": "string", "relationship": "string" } ] }, "sophistication": "Aspirant", "schema_version": "1.3.30", "revision": 10, "planning_and_operational_support": "string", "type": "actor", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "intended_effect": "Account Takeover", "language": "string", "id": "string", "tlp": "green", "aliases": [ "string" ], "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "actor_types": [ "Cyber Espionage Operations" ] } ], "description": "a list of `NewActor`s." }, "assets": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "asset" ], "example": "asset", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Specifies the time range during which the asset is considered valid or accurate.\nFor example, if an asset entity represents a device, the `valid_time` field could be used to indicate the period during which the device's configuration information is deemed accurate." }, "asset_type": { "type": "string", "enum": [ "application", "data", "device", "network", "person" ], "example": "application", "description": "Type of the Asset: Device, Person, Application, etc." } }, "required": [ "source", "valid_time", "asset_type" ], "example": { "description": "string", "asset_type": "application", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "type": "asset", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z" }, "description": "Schema for submitting new Assets" }, "uniqueItems": true, "example": [ { "description": "string", "asset_type": "application", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "type": "asset", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z" } ], "description": "a list of `NewAsset`s." }, "asset_mappings": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "asset-mapping" ], "example": "asset-mapping", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "For each asset, we allow for the assertion of time bound properties.This gives us both a record of the current state of the asset,as well as history." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "Level of confidence held in the characterization of this AssetMapping e.g.: is it susceptible to manipulation or translation?" }, "specificity": { "type": "string", "enum": [ "Low", "Medium", "Unique" ], "example": "Low", "description": "Denotes the level of how many assets potentially could have this same identifier." }, "stability": { "type": "string", "enum": [ "Managed", "Physical", "Temporary" ], "example": "Managed", "description": "Do we manage when it changes, or is it always a time bound assignment?" }, "observable": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "An AssetMapping is a record that a specific Observable maps to an Asset for an indicated period of time." }, "asset_ref": { "type": "string", "example": "string", "description": "URI that points to the mapped Asset." }, "asset_type": { "type": "string", "enum": [ "application", "data", "device", "network", "person" ], "example": "application", "description": "Type of the mapped Asset: Device, Person, Application, etc." } }, "required": [ "source", "valid_time", "confidence", "specificity", "stability", "observable", "asset_ref", "asset_type" ], "example": { "asset_type": "application", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "stability": "Managed", "schema_version": "1.3.30", "revision": 10, "observable": { "value": "1.2.3.4", "type": "ip" }, "asset_ref": "string", "type": "asset-mapping", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "specificity": "Low", "confidence": "High" }, "description": "Schema for submitting new AssetMapping." }, "uniqueItems": true, "example": [ { "asset_type": "application", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "stability": "Managed", "schema_version": "1.3.30", "revision": 10, "observable": { "value": "1.2.3.4", "type": "ip" }, "asset_ref": "string", "type": "asset-mapping", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "specificity": "Low", "confidence": "High" } ], "description": "a list of `NewAssetMapping`s." }, "asset_properties": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "asset-properties" ], "example": "asset-properties", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "The time range during which the AssetProperties is considered valid." }, "asset_ref": { "type": "string", "example": "string", "description": "URI that points to the associated Asset." }, "properties": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string", "example": "string", "description": "The properties are an open vocabulary." }, "value": { "type": "string", "example": "string" } }, "required": [ "name", "value" ], "example": { "name": "string", "value": "string" } }, "example": [ { "name": "string", "value": "string" } ] } }, "required": [ "source", "valid_time", "asset_ref" ], "example": { "properties": [ { "name": "string", "value": "string" } ], "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "asset_ref": "string", "type": "asset-properties", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z" }, "description": "Schema for submitting new AssetProperties" }, "uniqueItems": true, "example": [ { "properties": [ { "name": "string", "value": "string" } ], "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "asset_ref": "string", "type": "asset-properties", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z" } ], "description": "a list of `NewAssetProperties`s." }, "attack_patterns": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "attack-pattern" ], "example": "attack-pattern", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "kill_chain_phases": { "type": "array", "items": { "type": "object", "properties": { "kill_chain_name": { "type": "string", "example": "string", "description": "The name of the kill chain." }, "phase_name": { "type": "string", "example": "string", "description": "The name of the phase in the kill chain." } }, "required": [ "kill_chain_name", "phase_name" ], "example": { "kill_chain_name": "string", "phase_name": "string" }, "description": "The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives." }, "example": [ { "kill_chain_name": "string", "phase_name": "string" } ], "description": "A kill chain is a series of steps that an attacker must go through to successfully achieve their objective. The concept was originally developed by the military, but has been adapted to the cybersecurity field to describe the steps an attacker goes through to compromise a target system and achieve their goal." }, "x_mitre_data_sources": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "ATT&CK Technique.Data Sources." }, "x_mitre_platforms": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "ATT&CK Technique.Platforms." }, "x_mitre_contributors": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "ATT&CK Technique.Contributors." }, "abstraction_level": { "type": "string", "enum": [ "aggregate", "category", "detailed", "meta", "standard" ], "example": "aggregate", "description": "The CAPEC abstraction level for patterns describing techniques to attack a system." } }, "required": [ "title", "description", "short_description" ], "example": { "description": "string", "abstraction_level": "aggregate", "schema_version": "1.3.30", "revision": 10, "type": "attack-pattern", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "x_mitre_platforms": [ "string" ], "language": "string", "id": "string", "tlp": "green", "x_mitre_data_sources": [ "string" ], "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "x_mitre_contributors": [ "string" ], "timestamp": "2016-01-01T01:01:01Z" }, "description": "For submitting a new AttackPattern" }, "uniqueItems": true, "example": [ { "description": "string", "abstraction_level": "aggregate", "schema_version": "1.3.30", "revision": 10, "type": "attack-pattern", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "x_mitre_platforms": [ "string" ], "language": "string", "id": "string", "tlp": "green", "x_mitre_data_sources": [ "string" ], "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "x_mitre_contributors": [ "string" ], "timestamp": "2016-01-01T01:01:01Z" } ], "description": "a list of `NewAttackPattern`s." }, "campaigns": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "campaign" ], "example": "campaign", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Timestamp for the definition of a specific version of a campaign." }, "campaign_type": { "type": "string", "example": "string", "description": "String value that describes the type of campaign. For example, a campaign type could be 'Ransomware', 'Advanced Persistent Threat', 'Business Email Compromise', 'Phishing', etc. " }, "names": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "Used to capture alternate names or aliases associated with the campaign. A cyberattack campaign may have multiple names or aliases depending on the group or actor(s) behind the attack, e.g., 'Wannacry' is also known as 'WannaCrypt', 'WCry', 'Wanna Decryptor', etc." }, "intended_effect": { "type": "array", "items": { "type": "string", "example": "Account Takeover" }, "example": [ "Account Takeover" ], "description": "Characterizes the intended effect of this cyber threat campaign." }, "status": { "type": "string", "enum": [ "Future", "Historic", "Ongoing" ], "example": "Future", "description": "Indicates current Status of the Campaign. \n\nCan have one of the following values: \n\n- Ongoing: Indicates that the campaign is currently active and ongoing. For example, a mass phishing campaign that is actively targeting users is considered 'ongoing'.\n\n- Historic: Campaign has already occurred and is now in the past.\n\n- Future: This indicates that a campaign is planned or expected to occur in the future. For example, a threat actor may announce their intention to launch a specific cyberattack campaign at a future date." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "Level of confidence held in the characterization of this Campaign." }, "activity": { "type": "array", "items": { "type": "object", "properties": { "date_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Specifies the date and time at which the activity occured." }, "description": { "type": "string", "example": "string", "description": "A description of the activity." } }, "required": [ "date_time", "description" ], "example": { "date_time": "2016-01-01T01:01:01Z", "description": "string" }, "description": "Captures the specific activities or tactics associated with the entity. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc." }, "example": [ { "date_time": "2016-01-01T01:01:01Z", "description": "string" } ], "description": "Used to capture specific activities or tactics associated with the campaign.\nThe 'activity' field is an array of objects, and each element represents a specific activity and time associated with the campaign. Examples of activities may include malicious software delivery, command and control communication, network reconnaissance, data exfiltration, etc. By capturing these activities analysts can identify the specific tactics used by the threat actor(s) behind the campaign." } }, "required": [ "title", "description", "short_description", "campaign_type" ], "example": { "description": "string", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "type": "campaign", "campaign_type": "string", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "activity": [ { "date_time": "2016-01-01T01:01:01Z", "description": "string" } ], "source_uri": "string", "intended_effect": [ "Account Takeover" ], "status": "Future", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "names": [ "string" ] }, "description": "Schema for submitting new Campaigns" }, "uniqueItems": true, "example": [ { "description": "string", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "type": "campaign", "campaign_type": "string", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "activity": [ { "date_time": "2016-01-01T01:01:01Z", "description": "string" } ], "source_uri": "string", "intended_effect": [ "Account Takeover" ], "status": "Future", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "names": [ "string" ] } ], "description": "a list of `NewCampaign`s." }, "coas": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "coa" ], "example": "coa", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid." }, "stage": { "type": "string", "enum": [ "Containment", "Eradication", "Identification", "Lessons Learned", "Preparation", "Recovery", "Remedy", "Response" ], "example": "Containment", "description": "Specifies what stage in the cyber threat management lifecycle this Course Of Action is relevant to." }, "coa_type": { "type": "string", "enum": [ "Diplomatic Actions", "Eradication", "Hardening", "Internal Blocking", "Logical Access Restrictions", "Monitoring", "Other", "Patching", "Perimeter Blocking", "Phase", "Physical Access Restrictions", "Playbook", "Policy Actions", "Public Disclosure", "Rebuilding", "Redirection", "Redirection (Honey Pot)", "Task", "Training" ], "example": "Diplomatic Actions", "description": "The type of this COA" }, "objective": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "Characterizes the objective to provide guidance on how to mitigate a security incident that has been identified." }, "impact": { "type": "string", "example": "string", "description": "Characterizes the estimated impact of applying this course of action." }, "cost": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "Characterizes the estimated cost for applying this course of action." }, "efficacy": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "Effectiveness of this course of action in achieving its targeted objective." }, "related_COAs": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "source": { "type": "string", "example": "string" }, "relationship": { "type": "string", "example": "string" }, "COA_id": { "type": "string", "example": "string", "description": "A URI leading to a COA." } }, "required": [ "COA_id" ], "example": { "confidence": "High", "source": "string", "relationship": "string", "COA_id": "string" } }, "example": [ { "confidence": "High", "source": "string", "relationship": "string", "COA_id": "string" } ], "description": "Identifies or characterizes relationships to one or more related courses of action." }, "structured_coa_type": { "type": "string", "enum": [ "openc2" ], "example": "openc2" }, "open_c2_coa": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "structured_coa" ], "example": "structured_coa" }, "id": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "action": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "alert", "allow", "augment", "contain", "delete", "deny", "detonate", "distill", "get", "investigate", "locate", "mitigate", "modify", "move", "notify", "other", "pause", "query", "redirect", "remediate", "report", "response", "restart", "restore", "resume", "save", "scan", "set", "snapshot", "start", "stop", "substitute", "sync", "throttle", "update" ], "example": "alert" } }, "required": [ "type" ], "example": { "type": "alert" } }, "target": { "type": "object", "properties": { "type": { "type": "string", "example": "acudid" }, "specifiers": { "type": "string", "example": "string", "description": "Observable types that can be acted upon." } }, "required": [ "type" ], "example": { "type": "acudid", "specifiers": "string" } }, "actuator": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "endpoint", "endpoint.digital-telephone-handset", "endpoint.laptop", "endpoint.pos-terminal", "endpoint.printer", "endpoint.sensor", "endpoint.server", "endpoint.smart-meter", "endpoint.smart-phone", "endpoint.tablet", "endpoint.workstation", "network", "network.bridge", "network.firewall", "network.gateway", "network.guard", "network.hips", "network.hub", "network.ids", "network.ips", "network.modem", "network.nic", "network.proxy", "network.router", "network.security_manager", "network.sense_making", "network.sensor", "network.switch", "network.vpn", "network.wap", "other", "process", "process.aaa-server", "process.anti-virus-scanner", "process.connection-scanner", "process.directory-service", "process.dns-server", "process.email-service", "process.file-scanner", "process.location-service", "process.network-scanner", "process.remediation-service", "process.reputation-service", "process.sandbox", "process.virtualization-service", "process.vulnerability-scanner" ], "example": "endpoint" }, "specifiers": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "List of additional properties describing the actuator." } }, "required": [ "type" ], "example": { "type": "endpoint", "specifiers": [ "string" ] } }, "modifiers": { "type": "object", "properties": { "delay": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard." }, "duration": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard." }, "frequency": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "id": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid." }, "response": { "type": "string", "enum": [ "acknowledge", "command-ref", "query", "status" ], "example": "acknowledge" }, "source": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "destination": { "type": "string", "enum": [ "copy-to", "modify-to", "move-to", "report-to", "restore-point", "save-to", "set-to" ], "example": "copy-to" }, "method": { "type": "array", "items": { "type": "string", "enum": [ "acl", "authenticated", "blackhole", "blacklist", "graceful", "hibernate", "honeypot", "immediate", "segmentation", "spawn", "suspend", "unauthenticated", "whitelist" ], "example": "acl" }, "example": [ "acl" ] }, "search": { "type": "string", "enum": [ "cve", "patch", "signature", "vendor_bulletin" ], "example": "cve" }, "location": { "type": "string", "enum": [ "internal", "perimeter" ], "example": "internal" }, "option": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "additional_properties": { "type": "object", "properties": { "context": { "type": "string", "example": "string", "description": "String with at most 1024 characters." } }, "required": [ "context" ], "example": { "context": "string" } } }, "example": { "response": "acknowledge", "method": [ "acl" ], "additional_properties": { "context": "string" }, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "frequency": "string", "duration": "2016-01-01T01:01:01Z", "source": "string", "search": "cve", "option": "string", "id": "string", "location": "internal", "delay": "2016-01-01T01:01:01Z", "destination": "copy-to" } } }, "required": [ "type", "action" ], "example": { "type": "structured_coa", "id": "string", "action": { "type": "alert" }, "target": { "type": "acudid", "specifiers": "string" }, "actuator": { "type": "endpoint", "specifiers": [ "string" ] }, "modifiers": { "response": "acknowledge", "method": [ "acl" ], "additional_properties": { "context": "string" }, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "frequency": "string", "duration": "2016-01-01T01:01:01Z", "source": "string", "search": "cve", "option": "string", "id": "string", "location": "internal", "delay": "2016-01-01T01:01:01Z", "destination": "copy-to" } } } }, "example": { "description": "string", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "stage": "Containment", "schema_version": "1.3.30", "revision": 10, "efficacy": "High", "type": "coa", "related_COAs": [ { "confidence": "High", "source": "string", "relationship": "string", "COA_id": "string" } ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "coa_type": "Diplomatic Actions", "language": "string", "id": "string", "tlp": "green", "objective": [ "string" ], "cost": "High", "timestamp": "2016-01-01T01:01:01Z", "open_c2_coa": { "type": "structured_coa", "id": "string", "action": { "type": "alert" }, "target": { "type": "acudid", "specifiers": "string" }, "actuator": { "type": "endpoint", "specifiers": [ "string" ] }, "modifiers": { "response": "acknowledge", "method": [ "acl" ], "additional_properties": { "context": "string" }, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "frequency": "string", "duration": "2016-01-01T01:01:01Z", "source": "string", "search": "cve", "option": "string", "id": "string", "location": "internal", "delay": "2016-01-01T01:01:01Z", "destination": "copy-to" } }, "structured_coa_type": "openc2", "impact": "string" }, "description": "Schema for submitting new COAs" }, "uniqueItems": true, "example": [ { "description": "string", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "stage": "Containment", "schema_version": "1.3.30", "revision": 10, "efficacy": "High", "type": "coa", "related_COAs": [ { "confidence": "High", "source": "string", "relationship": "string", "COA_id": "string" } ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "coa_type": "Diplomatic Actions", "language": "string", "id": "string", "tlp": "green", "objective": [ "string" ], "cost": "High", "timestamp": "2016-01-01T01:01:01Z", "open_c2_coa": { "type": "structured_coa", "id": "string", "action": { "type": "alert" }, "target": { "type": "acudid", "specifiers": "string" }, "actuator": { "type": "endpoint", "specifiers": [ "string" ] }, "modifiers": { "response": "acknowledge", "method": [ "acl" ], "additional_properties": { "context": "string" }, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "frequency": "string", "duration": "2016-01-01T01:01:01Z", "source": "string", "search": "cve", "option": "string", "id": "string", "location": "internal", "delay": "2016-01-01T01:01:01Z", "destination": "copy-to" } }, "structured_coa_type": "openc2", "impact": "string" } ], "description": "a list of `NewCOA`s." }, "feedbacks": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "feedback" ], "example": "feedback", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "entity_id": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "feedback": { "type": "integer", "enum": [ -1, 0, 1 ], "example": -1 }, "reason": { "type": "string", "example": "string" } }, "required": [ "entity_id", "feedback", "reason" ], "example": { "feedback": -1, "schema_version": "1.3.30", "revision": 10, "type": "feedback", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "reason": "string", "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "entity_id": "string", "timestamp": "2016-01-01T01:01:01Z" }, "description": "Schema for submitting new Feedback." }, "uniqueItems": true, "example": [ { "feedback": -1, "schema_version": "1.3.30", "revision": 10, "type": "feedback", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "reason": "string", "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "entity_id": "string", "timestamp": "2016-01-01T01:01:01Z" } ], "description": "a list of `NewFeedback`s." }, "incidents": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "incident" ], "example": "incident", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "Represents the level of certainty or trustworthiness associated with the incident. It denotes the reliability of the intelligence associated with the incident.\nThe `confidence` field can take on several values, including:\n- `info`: Indicates that the incident information is based on sources with no previous track record or there is no track record for the source reporting the incident.\n- `low`: Indicates that the incident information is based on sources with a questionable track record or there is limited information about the accuracy of the source.\n- `medium`: Indicates that the incident information is based on sources with a mixed track record or of uncertain reliability.\n- `high`: Indicates that the incident information is based on sources with a proven track record and high degree of reliability.\nThe `confidence` field can be used to indicate the level of trust and confidence that can be attributed to the incident, and it may impact how the incident is prioritized, analyzed and addressed. It can also help in the decision-making process associated with the incident response activities.\nIt is important to note that the `confidence` field is subjective and can be interpreted differently by different organizations or analysts. As such, it is often used in conjunction with other intelligence attributes, such as the `severity` field, to provide a more complete picture of the incident." }, "status": { "type": "string", "enum": [ "Closed", "Closed: Confirmed Threat", "Closed: False Positive", "Closed: Merged", "Closed: Near-Miss", "Closed: Other", "Closed: Suspected", "Closed: Under Review", "Containment Achieved", "Hold", "Hold: External", "Hold: Internal", "Hold: Legal", "Incident Reported", "New", "New: Presented", "New: Processing", "Open", "Open: Contained", "Open: Investigating", "Open: Recovered", "Open: Reported", "Rejected", "Restoration Achieved", "Stalled" ], "example": "Closed", "description": "The `status` field represents the current state of an incident within the incident management process. Its values help in tracking and reporting the progress of the incident from its discovery to its resolution." }, "incident_time": { "type": "object", "properties": { "opened": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time the incident was first opened." }, "discovered": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time the incident was first discovered." }, "reported": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time the incident was first reported." }, "remediated": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time that the remediation of the damage from the incident was completed." }, "closed": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time that the incident was last closed." }, "rejected": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time that the incident was first rejected." }, "contained": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time that the incident was first contained." } }, "required": [ "opened" ], "example": { "opened": "2016-01-01T01:01:01Z", "discovered": "2016-01-01T01:01:01Z", "reported": "2016-01-01T01:01:01Z", "remediated": "2016-01-01T01:01:01Z", "closed": "2016-01-01T01:01:01Z", "rejected": "2016-01-01T01:01:01Z", "contained": "2016-01-01T01:01:01Z" }, "description": "Relevant time values associated with this Incident." }, "meta": { "type": "object", "additionalProperties": { "type": "string", "example": "string", "x-anyOf": [ { "type": "string", "example": "string" }, { "type": "number", "format": "double", "example": 10.0 }, { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z" }, { "type": "string", "example": "keyword" }, { "type": "boolean", "example": true } ] }, "example": { "keyword": "string" }, "description": "metadata associated to the incident.", "properties": {} }, "scores": { "type": "object", "additionalProperties": { "type": "number", "format": "double", "example": 10.0, "description": "A non-negative score number." }, "example": { "asset": 10.0 }, "description": "Used to indicate the severity or impact score of the threat represented by the incident.", "properties": {} }, "categories": { "type": "array", "items": { "type": "string", "example": "Attrition" }, "example": [ "Attrition" ], "description": "A set of categories for this incident." }, "discovery_method": { "type": "string", "example": "Agent Disclosure", "description": "Identifies how the incident was discovered." }, "intended_effect": { "type": "string", "example": "Account Takeover", "description": "Specifies the suspected intended effect of this incident" }, "assignees": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "A set of owners assigned to this incident." }, "detection_sources": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "example": [ "string" ], "description": "A set of sources that contributed threat detections to the incident." }, "promotion_method": { "type": "string", "enum": [ "Automated", "Manual" ], "example": "Automated", "description": "Describes method for promoting an Incident, whether manually or automatically. An Incident may be created manually by a SOAR analyst or SOC operator, or through an automated correlation or aggregation rule or engine that matches a specific set of events or alerts, and promotes them to Incident(s)." }, "detection_status": { "type": "string", "enum": [ "active", "inactive_expired", "inactive_merged", "inactive_oversized", "inactive_user_closed" ], "example": "active", "description": "Represents the state of an incident within the incident generation process, indicating whether the incident is actively receiving updates or is no longer being updated." }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "Critical", "description": "Represents the potential impact of an incident on an organization's security posture and business operations. It helps organizations prioritize and allocate resources for incident response based on the severity level of the incident \nIt helps analysts and incident handlers prioritize incidents by indicating the level of risk and potential impact associated with the incident. This enables organizations to allocate resources efficiently and address the most critical incidents first.\nCan also be used to generate reports and metrics for measuring the effectiveness of the incident response process and to identify trends and patterns in the threat landscape.\nIt is important to note that the `severity` field is subjective and can be interpreted differently by different organizations or analysts. Therefore, it should be used in conjunction with other intelligence attributes, such as the `confidence` field, to provide a more comprehensive view of the incident." }, "tactics": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "Represents the offensive techniques, approaches, or procedures that an adversary may use to achieve their objectives during an attack. It helps in understanding the intent and capabilities of the adversary and can be used to identify indicators of attack (IoAs) or indicators of compromise (IoCs) that are associated with the adversary's tactics." }, "techniques": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "Represents the specific methods or actions used by an attacker to carry out an offensive maneuver or achieve their goals." }, "short_id": { "type": "string", "example": "string", "description": "A human-readable, short identifier for the incident, unique within an organization." } }, "required": [ "confidence", "status", "incident_time" ], "example": { "description": "string", "assignees": [ "string" ], "detection_sources": [ "string" ], "meta": { "keyword": "string" }, "schema_version": "1.3.30", "revision": 10, "type": "incident", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "incident_time": { "opened": "2016-01-01T01:01:01Z", "discovered": "2016-01-01T01:01:01Z", "reported": "2016-01-01T01:01:01Z", "remediated": "2016-01-01T01:01:01Z", "closed": "2016-01-01T01:01:01Z", "rejected": "2016-01-01T01:01:01Z", "contained": "2016-01-01T01:01:01Z" }, "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "discovery_method": "Agent Disclosure", "source_uri": "string", "intended_effect": "Account Takeover", "categories": [ "Attrition" ], "status": "Closed", "language": "string", "detection_status": "active", "id": "string", "promotion_method": "Automated", "severity": "Critical", "tlp": "green", "scores": { "asset": 10.0 }, "techniques": [ "string" ], "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "short_id": "string", "tactics": [ "string" ] }, "description": "For submitting a new Incident." }, "uniqueItems": true, "example": [ { "description": "string", "assignees": [ "string" ], "detection_sources": [ "string" ], "meta": { "keyword": "string" }, "schema_version": "1.3.30", "revision": 10, "type": "incident", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "incident_time": { "opened": "2016-01-01T01:01:01Z", "discovered": "2016-01-01T01:01:01Z", "reported": "2016-01-01T01:01:01Z", "remediated": "2016-01-01T01:01:01Z", "closed": "2016-01-01T01:01:01Z", "rejected": "2016-01-01T01:01:01Z", "contained": "2016-01-01T01:01:01Z" }, "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "discovery_method": "Agent Disclosure", "source_uri": "string", "intended_effect": "Account Takeover", "categories": [ "Attrition" ], "status": "Closed", "language": "string", "detection_status": "active", "id": "string", "promotion_method": "Automated", "severity": "Critical", "tlp": "green", "scores": { "asset": 10.0 }, "techniques": [ "string" ], "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "short_id": "string", "tactics": [ "string" ] } ], "description": "a list of `NewIncident`s." }, "indicators": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "indicator" ], "example": "indicator", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "The time range during which this Indicator is considered valid." }, "producer": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "Critical" }, "negate": { "type": "boolean", "example": true, "description": "Specifies the absence of the pattern." }, "indicator_type": { "type": "array", "items": { "type": "string", "enum": [ "Anonymization", "C2", "Compromised PKI Certificate", "Domain Watchlist", "Exfiltration", "File Hash Watchlist", "Host Characteristics", "IMEI Watchlist", "IMSI Watchlist", "IP Watchlist", "Login Name", "Malicious E-mail", "Malware Artifacts", "Private Threat Feed", "URL Watchlist" ], "example": "Anonymization" }, "example": [ "Anonymization" ], "description": "Specifies the type or types for this Indicator." }, "tags": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "Descriptors for this indicator." }, "composite_indicator_expression": { "type": "object", "properties": { "operator": { "type": "string", "enum": [ "and", "not", "or" ], "example": "and" }, "indicator_ids": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an indicator." }, "example": [ "string" ] } }, "required": [ "operator", "indicator_ids" ], "example": { "operator": "and", "indicator_ids": [ "string" ] } }, "likely_impact": { "type": "string", "example": "string", "description": "Likely potential impact within the relevant context if this Indicator were to occur." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "level of confidence held in the accuracy of this Indicator." }, "kill_chain_phases": { "type": "array", "items": { "type": "object", "properties": { "kill_chain_name": { "type": "string", "example": "string", "description": "The name of the kill chain." }, "phase_name": { "type": "string", "example": "string", "description": "The name of the phase in the kill chain." } }, "required": [ "kill_chain_name", "phase_name" ], "example": { "kill_chain_name": "string", "phase_name": "string" }, "description": "The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives." }, "example": [ { "kill_chain_name": "string", "phase_name": "string" } ], "description": "Relevant kill chain phases indicated by this Indicator." }, "test_mechanisms": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "example": [ "string" ], "description": "Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator." }, "specification": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Judgement" ], "example": "Judgement" }, "judgements": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to a judgement." }, "example": [ "string" ] }, "required_judgements": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "source": { "type": "string", "example": "string" }, "relationship": { "type": "string", "example": "string" }, "judgement_id": { "type": "string", "example": "string", "description": "A URI leading to a judgement." } }, "required": [ "judgement_id" ], "example": { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } }, "example": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "required": [ "type", "judgements", "required_judgements" ], "example": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] }, "description": "An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.", "x-anyOf": [ { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Judgement" ], "example": "Judgement" }, "judgements": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to a judgement." }, "example": [ "string" ] }, "required_judgements": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "source": { "type": "string", "example": "string" }, "relationship": { "type": "string", "example": "string" }, "judgement_id": { "type": "string", "example": "string", "description": "A URI leading to a judgement." } }, "required": [ "judgement_id" ], "example": { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } }, "example": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "required": [ "type", "judgements", "required_judgements" ], "example": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] }, "description": "An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "ThreatBrain" ], "example": "ThreatBrain" }, "query": { "type": "string", "example": "string" }, "variables": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ] } }, "required": [ "type", "variables" ], "example": { "type": "ThreatBrain", "query": "string", "variables": [ "string" ] }, "description": "An indicator which runs in threatbrain..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Snort" ], "example": "Snort" }, "snort_sig": { "type": "string", "example": "string" } }, "required": [ "type", "snort_sig" ], "example": { "type": "Snort", "snort_sig": "string" }, "description": "An indicator which runs in snort..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "SIOC" ], "example": "SIOC" }, "SIOC": { "type": "string", "example": "string" } }, "required": [ "type", "SIOC" ], "example": { "type": "SIOC", "SIOC": "string" }, "description": "An indicator which runs in snort..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "OpenIOC" ], "example": "OpenIOC" }, "open_IOC": { "type": "string", "example": "string" } }, "required": [ "type", "open_IOC" ], "example": { "type": "OpenIOC", "open_IOC": "string" }, "description": "An indicator which contains an XML blob of an openIOC indicator." } ] } }, "required": [ "producer" ], "example": { "description": "string", "tags": [ "string" ], "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "producer": "string", "schema_version": "1.3.30", "revision": 10, "type": "indicator", "test_mechanisms": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "composite_indicator_expression": { "operator": "and", "indicator_ids": [ "string" ] }, "title": "string", "likely_impact": "string", "indicator_type": [ "Anonymization" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "severity": "Critical", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "negate": true, "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "specification": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "description": "For submitting a new Indicator" }, "uniqueItems": true, "example": [ { "description": "string", "tags": [ "string" ], "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "producer": "string", "schema_version": "1.3.30", "revision": 10, "type": "indicator", "test_mechanisms": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "composite_indicator_expression": { "operator": "and", "indicator_ids": [ "string" ] }, "title": "string", "likely_impact": "string", "indicator_type": [ "Anonymization" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "severity": "Critical", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "negate": true, "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "specification": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } } ], "description": "a list of `NewIndicator`s." }, "judgements": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "judgement" ], "example": "judgement", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "observable": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." }, "disposition": { "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Matches :disposition_name as in {1 \"Clean\", 2 \"Malicious\", 3 \"Suspicious\", 4 \"Common\", 5 \"Unknown\"}" }, "disposition_name": { "type": "string", "enum": [ "Clean", "Common", "Malicious", "Suspicious", "Unknown" ], "example": "Clean", "description": "String verdict identifiers." }, "priority": { "type": "integer", "format": "int64", "example": 10, "description": "A value 0-100 that determine the priority of a judgement. Curated feeds of black/white lists, for example known good products within your organizations, should use a 95. All automated systems should use a priority of 90, or less. Human judgements should have a priority of 100, so that humans can always override machines." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "Critical" }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid." }, "reason": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "reason_uri": { "type": "string", "example": "string", "description": "A URI" } }, "required": [ "source", "observable", "priority", "confidence", "severity" ], "example": { "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "observable": { "value": "1.2.3.4", "type": "ip" }, "reason_uri": "string", "type": "judgement", "source": "string", "external_ids": [ "string" ], "disposition": 1, "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "reason": "string", "source_uri": "string", "disposition_name": "Clean", "priority": 10, "language": "string", "id": "string", "severity": "Critical", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "confidence": "High" }, "description": "Schema for submitting new Judgements." }, "uniqueItems": true, "example": [ { "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "observable": { "value": "1.2.3.4", "type": "ip" }, "reason_uri": "string", "type": "judgement", "source": "string", "external_ids": [ "string" ], "disposition": 1, "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "reason": "string", "source_uri": "string", "disposition_name": "Clean", "priority": 10, "language": "string", "id": "string", "severity": "Critical", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "confidence": "High" } ], "description": "a list of `NewJudgement`s." }, "malwares": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "malware" ], "example": "malware", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "labels": { "type": "array", "items": { "type": "string", "example": "adware", "description": "Malware label is an open vocabulary that represents different types and functions of malware. Malware labels are not mutually exclusive; a malware instance can be both spyware and a screen capture tool." }, "example": [ "adware" ], "description": "The type of malware being described." }, "kill_chain_phases": { "type": "array", "items": { "type": "object", "properties": { "kill_chain_name": { "type": "string", "example": "string", "description": "The name of the kill chain." }, "phase_name": { "type": "string", "example": "string", "description": "The name of the phase in the kill chain." } }, "required": [ "kill_chain_name", "phase_name" ], "example": { "kill_chain_name": "string", "phase_name": "string" }, "description": "The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives." }, "example": [ { "kill_chain_name": "string", "phase_name": "string" } ], "description": "The list of Kill Chain Phases for which this Malware can be used." }, "x_mitre_aliases": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "ATT&CK Software.aliases." }, "abstraction_level": { "type": "string", "enum": [ "family", "variant", "version" ], "example": "family", "description": "Malware abstraction level." } }, "required": [ "title", "description", "short_description", "labels" ], "example": { "description": "string", "labels": [ "adware" ], "abstraction_level": "family", "schema_version": "1.3.30", "revision": 10, "type": "malware", "x_mitre_aliases": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "timestamp": "2016-01-01T01:01:01Z" }, "description": "For submitting a new Malware." }, "uniqueItems": true, "example": [ { "description": "string", "labels": [ "adware" ], "abstraction_level": "family", "schema_version": "1.3.30", "revision": 10, "type": "malware", "x_mitre_aliases": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "timestamp": "2016-01-01T01:01:01Z" } ], "description": "a list of `NewMalware`s." }, "notes": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "note" ], "example": "note", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "note_class": { "type": "string", "example": "keyword" }, "content": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "related_entities": { "type": "array", "items": { "type": "object", "properties": { "entity_type": { "type": "string", "example": "string" }, "entity_id": { "type": "string", "example": "string", "description": "A URI leading to an entity." } }, "required": [ "entity_type", "entity_id" ], "example": { "entity_type": "string", "entity_id": "string" } }, "example": [ { "entity_type": "string", "entity_id": "string" } ] }, "author": { "type": "string", "example": "string" } }, "required": [ "note_class", "content", "related_entities" ], "example": { "schema_version": "1.3.30", "revision": 10, "content": "string", "note_class": "keyword", "type": "note", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "author": "string", "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "related_entities": [ { "entity_type": "string", "entity_id": "string" } ] }, "description": "Schema for submitting Notes" }, "uniqueItems": true, "example": [ { "schema_version": "1.3.30", "revision": 10, "content": "string", "note_class": "keyword", "type": "note", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "author": "string", "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "related_entities": [ { "entity_type": "string", "entity_id": "string" } ] } ], "description": "a list of `NewNote`s." }, "relationships": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "relationship" ], "example": "relationship", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "relationship_type": { "type": "string", "example": "attributed-to" }, "source_ref": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "target_ref": { "type": "string", "example": "string", "description": "A URI leading to an entity." } }, "required": [ "relationship_type", "source_ref", "target_ref" ], "example": { "description": "string", "schema_version": "1.3.30", "revision": 10, "target_ref": "string", "type": "relationship", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "source_ref": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "relationship_type": "attributed-to" }, "description": "Schema for submitting new Relationships." }, "uniqueItems": true, "example": [ { "description": "string", "schema_version": "1.3.30", "revision": 10, "target_ref": "string", "type": "relationship", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "source_ref": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "relationship_type": "attributed-to" } ], "description": "a list of `NewRelationship`s." }, "sightings": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "sighting" ], "example": "sighting", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "observed_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "count": { "type": "integer", "format": "int64", "example": 10, "description": "The number of times an indicator was observed within a certain period of time.\nFor example, if an IP address associated with known malicious activity is observed once within a period of time, it may indicate a low-level threat. However, if the same IP address is observed multiple times within a short time frame, it may indicate a more severe and persistent threat.\nIt can also be used to prioritize security alerts and indicate the urgency of a response. High counts indicate that an indicator is actively being used in a larger campaign, while low counts may indicate isolated incidents." }, "internal": { "type": "boolean", "example": false, "description": "If `true`, indicates that the sighting was reported from internal sources, such as an organization's own internal security tools or SOC.\n Internal sightings are often considered more reliable and actionable than external sightings, which are reported from external sources and may have a lower level of trustworthiness. Internal sightings can provide more context and can help identify potential threats that are unique to a particular environment or organization.\n Internal sightings can also help organizations prioritize their security response efforts by identifying threats that are specific to their environment and may not yet be widely known." }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "Critical" }, "resolution": { "type": "string", "example": "detected", "description": "Represents the disposition or actions taken on the associated threat intelligence." }, "data": { "type": "object", "properties": { "columns": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string", "example": "string" }, "type": { "type": "string", "enum": [ "integer", "markdown", "number", "observable", "string", "url" ], "example": "integer" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "required": { "type": "boolean", "example": true, "description": "If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`." }, "short_description": { "type": "string", "example": "string" } }, "required": [ "name", "type" ], "example": { "name": "string", "type": "integer", "description": "string", "required": true, "short_description": "string" } }, "example": [ { "name": "string", "type": "integer", "description": "string", "required": true, "short_description": "string" } ], "description": "an ordered list of column definitions" }, "rows": { "type": "array", "items": { "type": "array", "items": { "example": "anything" } }, "example": [ [ "anything" ] ], "description": "an ordered list of rows" }, "row_count": { "type": "integer", "format": "int64", "example": 10, "description": "The number of rows in the data table." } }, "required": [ "columns", "rows" ], "example": { "columns": [ { "name": "string", "type": "integer", "description": "string", "required": true, "short_description": "string" } ], "rows": [ [ "anything" ] ], "row_count": 10 }, "description": "An embedded data table for the Sighting." }, "sensor": { "type": "string", "example": "endpoint", "description": "The OpenC2 Actuator name that best fits the device that is creating this sighting (e.g. network.firewall)" }, "sensor_coordinates": { "type": "object", "properties": { "type": { "type": "string", "example": "endpoint", "description": "The sensor/actuator name that best fits a device." }, "observables": { "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." }, "example": [ { "value": "1.2.3.4", "type": "ip" } ] }, "os": { "type": "string", "example": "string" } }, "required": [ "type", "observables" ], "example": { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "os": "string" }, "description": "Describes the device that made the sighting (sensor) and contains identifying observables for the sensor." }, "targets": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "endpoint", "description": "The sensor/actuator name that best fits a device." }, "observables": { "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." }, "example": [ { "value": "1.2.3.4", "type": "ip" } ] }, "observed_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "os": { "type": "string", "example": "string" } }, "required": [ "type", "observables", "observed_time" ], "example": { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "os": "string" }, "description": "Describes the target of the sighting and contains identifying observables for the target." }, "example": [ { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "os": "string" } ], "description": "May include one or more targets that observed the associated indicator. Targets can include network devices, host devices, or other entities that are capable of detecting indicators of compromise.\n\nCan be used to assess the scope of potential threats, helping analysts understand which devices or components of the network may be vulnerable to attack. For example, if a particular malware strain is detected on several different systems within an organization, the `targets` field may indicate which systems are affected and which may need to be isolated or patched to prevent further spread." }, "observables": { "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." }, "example": [ { "value": "1.2.3.4", "type": "ip" } ], "description": "The object(s) of interest." }, "relations": { "type": "array", "items": { "type": "object", "properties": { "origin": { "type": "string", "example": "string" }, "origin_uri": { "type": "string", "example": "string", "description": "A URI" }, "relation": { "type": "string", "example": "Allocated" }, "relation_info": { "type": "object", "additionalProperties": { "example": "anything" }, "example": { "keyword": "anything" }, "properties": {} }, "source": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." }, "related": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." } }, "required": [ "origin", "relation", "source", "related" ], "example": { "origin": "string", "origin_uri": "string", "relation": "Allocated", "relation_info": { "keyword": "anything" }, "source": { "value": "1.2.3.4", "type": "ip" }, "related": { "value": "1.2.3.4", "type": "ip" } }, "description": "A relation inside a Sighting." }, "example": [ { "origin": "string", "origin_uri": "string", "relation": "Allocated", "relation_info": { "keyword": "anything" }, "source": { "value": "1.2.3.4", "type": "ip" }, "related": { "value": "1.2.3.4", "type": "ip" } } ], "description": "Provide any context we can about where the observable came from." }, "context": { "type": "object", "properties": { "process_create_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "type": { "type": "string", "enum": [ "ProcessCreateEvent" ], "example": "ProcessCreateEvent" }, "process_args": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "process_hash": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "process_size": { "type": "integer", "format": "int64", "example": 10 }, "process_disposition": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "parent_creation_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard." }, "parent_process_id": { "type": "integer", "format": "int64", "example": 10 }, "parent_process_guid": { "type": "integer", "format": "int64", "example": 10 }, "parent_process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "parent_process_args": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "parent_process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "parent_process_hash": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "parent_process_size": { "type": "integer", "format": "int64", "example": 10 }, "parent_process_disposition": { "type": "string", "example": "string", "description": "String with at most 1024 characters." } }, "required": [ "time", "process_id", "process_name", "type" ], "example": { "parent_process_name": "string", "process_guid": 10, "parent_process_guid": 10, "process_disposition": "string", "parent_process_size": 10, "process_size": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_disposition": "string", "type": "ProcessCreateEvent", "parent_process_username": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "parent_creation_time": "2016-01-01T01:01:01Z", "process_args": "string" } }, "example": [ { "parent_process_name": "string", "process_guid": 10, "parent_process_guid": 10, "process_disposition": "string", "parent_process_size": 10, "process_size": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_disposition": "string", "type": "ProcessCreateEvent", "parent_process_username": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "parent_creation_time": "2016-01-01T01:01:01Z", "process_args": "string" } ], "description": "a list of `ProcessCreate`" }, "library_load_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "type": { "type": "string", "enum": [ "LibraryLoadEvent" ], "example": "LibraryLoadEvent" }, "dll_library_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "dll_library_path": { "type": "string", "example": "string", "description": "String with at most 2048 characters." } }, "required": [ "time", "process_id", "process_name", "type", "dll_library_name", "dll_library_path" ], "example": { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "type": "LibraryLoadEvent", "dll_library_name": "string", "dll_library_path": "string" } }, "example": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "type": "LibraryLoadEvent", "dll_library_name": "string", "dll_library_path": "string" } ], "description": "a list of `LibraryLoadType`" }, "file_create_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "file_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "file_path": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "type": { "type": "string", "enum": [ "FileCreateEvent" ], "example": "FileCreateEvent" }, "failed": { "type": "boolean", "example": false } }, "required": [ "time", "process_id", "process_name", "file_name", "file_path", "type" ], "example": { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileCreateEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } }, "example": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileCreateEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "description": "a list of `FileCreateType`" }, "file_delete_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "file_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "file_path": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "type": { "type": "string", "enum": [ "FileDeleteEvent" ], "example": "FileDeleteEvent" }, "failed": { "type": "boolean", "example": false } }, "required": [ "time", "process_id", "process_name", "file_name", "file_path", "type" ], "example": { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileDeleteEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } }, "example": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileDeleteEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "description": "a list of `FileDeleteType`" }, "file_modify_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "file_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "file_path": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "type": { "type": "string", "enum": [ "FileModifyEvent" ], "example": "FileModifyEvent" }, "failed": { "type": "boolean", "example": false } }, "required": [ "time", "process_id", "process_name", "file_name", "file_path", "type" ], "example": { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileModifyEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } }, "example": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileModifyEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "description": "a list of `FileModifyType`" }, "file_move_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "file_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "file_path": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "type": { "type": "string", "enum": [ "FileMoveEvent" ], "example": "FileMoveEvent" }, "old_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "new_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." } }, "required": [ "time", "process_id", "process_name", "file_name", "file_path", "type", "old_name", "new_name" ], "example": { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileMoveEvent", "old_name": "string", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "new_name": "string" } }, "example": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileMoveEvent", "old_name": "string", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "new_name": "string" } ], "description": "a list of `FileMoveType`" }, "netflow_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "type": { "type": "string", "enum": [ "NetflowEvent" ], "example": "NetflowEvent" }, "traffic": { "type": "object", "properties": { "protocol": { "type": "integer", "format": "int64", "example": 10, "description": "The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)" }, "source_ip": { "type": "string", "example": "string" }, "destination_ip": { "type": "string", "example": "string" }, "source_port": { "type": "integer", "format": "int64", "example": 10 }, "destination_port": { "type": "integer", "format": "int64", "example": 10 }, "direction": { "type": "string", "enum": [ "incoming", "outgoing" ], "example": "incoming" }, "destination_host_name": { "type": "string", "example": "string" }, "source_subnet": { "type": "string", "example": "string" }, "destination_subnet": { "type": "string", "example": "string" } }, "required": [ "protocol", "source_ip", "destination_ip", "source_port", "destination_port", "direction" ], "example": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 } }, "process_path": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_args": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_hash": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_account_type": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_account": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "parent_process_id": { "type": "integer", "format": "int64", "example": 10 }, "parent_process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "parent_process_path": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "parent_process_args": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "parent_process_hash": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "parent_process_account": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "parent_process_account_type": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "flow_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Schema definition for all date or timestamp values. Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard." }, "byte_count_out": { "type": "integer", "format": "int64", "example": 10 }, "byte_count_in": { "type": "integer", "format": "int64", "example": 10 } }, "required": [ "time", "process_id", "process_name", "type", "traffic" ], "example": { "parent_process_name": "string", "byte_count_in": 10, "process_guid": 10, "process_path": "string", "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "flow_time": "2016-01-01T01:01:01Z", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_account": "string", "type": "NetflowEvent", "process_account_type": "string", "parent_process_path": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_account": "string", "parent_process_account_type": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "byte_count_out": 10, "process_args": "string" } }, "example": [ { "parent_process_name": "string", "byte_count_in": 10, "process_guid": 10, "process_path": "string", "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "flow_time": "2016-01-01T01:01:01Z", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_account": "string", "type": "NetflowEvent", "process_account_type": "string", "parent_process_path": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_account": "string", "parent_process_account_type": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "byte_count_out": 10, "process_args": "string" } ], "description": "a list of `NetflowType`" }, "http_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "type": { "type": "string", "enum": [ "HTTPEvent" ], "example": "HTTPEvent" }, "host": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "traffic": { "type": "object", "properties": { "protocol": { "type": "integer", "format": "int64", "example": 10, "description": "The IP [protocol id](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)" }, "source_ip": { "type": "string", "example": "string" }, "destination_ip": { "type": "string", "example": "string" }, "source_port": { "type": "integer", "format": "int64", "example": 10 }, "destination_port": { "type": "integer", "format": "int64", "example": 10 }, "direction": { "type": "string", "enum": [ "incoming", "outgoing" ], "example": "incoming" }, "destination_host_name": { "type": "string", "example": "string" }, "source_subnet": { "type": "string", "example": "string" }, "destination_subnet": { "type": "string", "example": "string" } }, "required": [ "protocol", "source_ip", "destination_ip", "source_port", "destination_port", "direction" ], "example": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 } }, "url_port": { "type": "integer", "format": "int64", "example": 10 }, "query": { "type": "string", "example": "string", "description": "String with at most 5000 characters." }, "encrypted": { "type": "boolean", "example": true }, "method": { "type": "string", "enum": [ "CONNECT", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT", "TRACE" ], "example": "CONNECT" } }, "required": [ "time", "process_id", "process_name", "type", "host", "traffic" ], "example": { "process_guid": 10, "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "method": "CONNECT", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "HTTPEvent", "host": "string", "process_name": "string", "process_id": 10, "process_username": "string", "query": "string", "encrypted": true, "url_port": 10 } }, "example": [ { "process_guid": 10, "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "method": "CONNECT", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "HTTPEvent", "host": "string", "process_name": "string", "process_id": 10, "process_username": "string", "query": "string", "encrypted": true, "url_port": 10 } ], "description": "a list of `HTTPType`" }, "registry_create_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "registry_key": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "type": { "type": "string", "enum": [ "RegistryCreateEvent" ], "example": "RegistryCreateEvent" } }, "required": [ "time", "process_id", "process_name", "registry_key", "type" ], "example": { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryCreateEvent" } }, "example": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryCreateEvent" } ], "description": "a list of `RegistryCreateType`" }, "registry_set_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "registry_key": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "type": { "type": "string", "enum": [ "RegistrySetEvent" ], "example": "RegistrySetEvent" }, "registry_value": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "registry_data_length": { "type": "integer", "format": "int64", "example": 10 }, "registry_data": { "type": "string", "example": "string", "description": "String with at most 5000 characters." } }, "required": [ "time", "process_id", "process_name", "registry_key", "type", "registry_value" ], "example": { "process_guid": 10, "registry_data": "string", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "RegistrySetEvent", "registry_data_length": 10, "registry_value": "string", "registry_key": "string", "process_name": "string", "process_id": 10, "process_username": "string" } }, "example": [ { "process_guid": 10, "registry_data": "string", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "RegistrySetEvent", "registry_data_length": 10, "registry_value": "string", "registry_key": "string", "process_name": "string", "process_id": 10, "process_username": "string" } ], "description": "a list of `RegistrySetType`" }, "registry_delete_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "registry_key": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "type": { "type": "string", "enum": [ "RegistryDeleteEvent" ], "example": "RegistryDeleteEvent" }, "registry_value": { "type": "string", "example": "string", "description": "String with at most 2048 characters." } }, "required": [ "time", "process_id", "process_name", "registry_key", "type" ], "example": { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryDeleteEvent", "registry_value": "string" } }, "example": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryDeleteEvent", "registry_value": "string" } ], "description": "a list of `RegistryDeleteType`" }, "registry_rename_events": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "process_id": { "type": "integer", "format": "int64", "example": 10 }, "process_name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "process_guid": { "type": "integer", "format": "int64", "example": 10 }, "process_username": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "registry_key": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "type": { "type": "string", "enum": [ "RegistryRenameEvent" ], "example": "RegistryRenameEvent" }, "registry_old_key": { "type": "string", "example": "string", "description": "String with at most 1024 characters." } }, "required": [ "time", "process_id", "process_name", "registry_key", "type", "registry_old_key" ], "example": { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryRenameEvent", "registry_old_key": "string" } }, "example": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryRenameEvent", "registry_old_key": "string" } ], "description": "a list of `RegistryRenameType`" } }, "example": { "http_events": [ { "process_guid": 10, "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "method": "CONNECT", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "HTTPEvent", "host": "string", "process_name": "string", "process_id": 10, "process_username": "string", "query": "string", "encrypted": true, "url_port": 10 } ], "process_create_events": [ { "parent_process_name": "string", "process_guid": 10, "parent_process_guid": 10, "process_disposition": "string", "parent_process_size": 10, "process_size": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_disposition": "string", "type": "ProcessCreateEvent", "parent_process_username": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "parent_creation_time": "2016-01-01T01:01:01Z", "process_args": "string" } ], "registry_delete_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryDeleteEvent", "registry_value": "string" } ], "file_modify_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileModifyEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "registry_set_events": [ { "process_guid": 10, "registry_data": "string", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "RegistrySetEvent", "registry_data_length": 10, "registry_value": "string", "registry_key": "string", "process_name": "string", "process_id": 10, "process_username": "string" } ], "file_create_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileCreateEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "registry_create_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryCreateEvent" } ], "library_load_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "type": "LibraryLoadEvent", "dll_library_name": "string", "dll_library_path": "string" } ], "file_move_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileMoveEvent", "old_name": "string", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "new_name": "string" } ], "file_delete_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileDeleteEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "netflow_events": [ { "parent_process_name": "string", "byte_count_in": 10, "process_guid": 10, "process_path": "string", "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "flow_time": "2016-01-01T01:01:01Z", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_account": "string", "type": "NetflowEvent", "process_account_type": "string", "parent_process_path": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_account": "string", "parent_process_account_type": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "byte_count_out": 10, "process_args": "string" } ], "registry_rename_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryRenameEvent", "registry_old_key": "string" } ] }, "description": "Context including the event type that best fits the type of the sighting." }, "activity_interval": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "The time interval during which the malicious activity occurred. For example, the time when a malware sample was executing, or the time range of a network intrusion." }, "detection_interval": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "The time interval during which the malicious activity was detected by the source engine or security tool. This may differ from the activity_interval if detection occurred after the activity." }, "modification_interval": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "The time interval during which the sighting record was created or last updated in the system." } }, "required": [ "observed_time" ], "example": { "description": "string", "schema_version": "1.3.30", "revision": 10, "relations": [ { "origin": "string", "origin_uri": "string", "relation": "Allocated", "relation_info": { "keyword": "anything" }, "source": { "value": "1.2.3.4", "type": "ip" }, "related": { "value": "1.2.3.4", "type": "ip" } } ], "sensor_coordinates": { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "os": "string" }, "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "type": "sighting", "source": "string", "external_ids": [ "string" ], "targets": [ { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "os": "string" } ], "short_description": "string", "title": "string", "resolution": "detected", "internal": false, "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "detection_interval": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "source_uri": "string", "activity_interval": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "language": "string", "id": "string", "count": 10, "severity": "Critical", "tlp": "green", "modification_interval": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "context": { "http_events": [ { "process_guid": 10, "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "method": "CONNECT", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "HTTPEvent", "host": "string", "process_name": "string", "process_id": 10, "process_username": "string", "query": "string", "encrypted": true, "url_port": 10 } ], "process_create_events": [ { "parent_process_name": "string", "process_guid": 10, "parent_process_guid": 10, "process_disposition": "string", "parent_process_size": 10, "process_size": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_disposition": "string", "type": "ProcessCreateEvent", "parent_process_username": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "parent_creation_time": "2016-01-01T01:01:01Z", "process_args": "string" } ], "registry_delete_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryDeleteEvent", "registry_value": "string" } ], "file_modify_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileModifyEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "registry_set_events": [ { "process_guid": 10, "registry_data": "string", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "RegistrySetEvent", "registry_data_length": 10, "registry_value": "string", "registry_key": "string", "process_name": "string", "process_id": 10, "process_username": "string" } ], "file_create_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileCreateEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "registry_create_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryCreateEvent" } ], "library_load_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "type": "LibraryLoadEvent", "dll_library_name": "string", "dll_library_path": "string" } ], "file_move_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileMoveEvent", "old_name": "string", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "new_name": "string" } ], "file_delete_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileDeleteEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "netflow_events": [ { "parent_process_name": "string", "byte_count_in": 10, "process_guid": 10, "process_path": "string", "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "flow_time": "2016-01-01T01:01:01Z", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_account": "string", "type": "NetflowEvent", "process_account_type": "string", "parent_process_path": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_account": "string", "parent_process_account_type": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "byte_count_out": 10, "process_args": "string" } ], "registry_rename_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryRenameEvent", "registry_old_key": "string" } ] }, "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "sensor": "endpoint", "data": { "columns": [ { "name": "string", "type": "integer", "description": "string", "required": true, "short_description": "string" } ], "rows": [ [ "anything" ] ], "row_count": 10 } }, "description": "For submitting a new Sighting." }, "uniqueItems": true, "example": [ { "description": "string", "schema_version": "1.3.30", "revision": 10, "relations": [ { "origin": "string", "origin_uri": "string", "relation": "Allocated", "relation_info": { "keyword": "anything" }, "source": { "value": "1.2.3.4", "type": "ip" }, "related": { "value": "1.2.3.4", "type": "ip" } } ], "sensor_coordinates": { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "os": "string" }, "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "type": "sighting", "source": "string", "external_ids": [ "string" ], "targets": [ { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "os": "string" } ], "short_description": "string", "title": "string", "resolution": "detected", "internal": false, "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "detection_interval": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "source_uri": "string", "activity_interval": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "language": "string", "id": "string", "count": 10, "severity": "Critical", "tlp": "green", "modification_interval": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "context": { "http_events": [ { "process_guid": 10, "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "method": "CONNECT", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "HTTPEvent", "host": "string", "process_name": "string", "process_id": 10, "process_username": "string", "query": "string", "encrypted": true, "url_port": 10 } ], "process_create_events": [ { "parent_process_name": "string", "process_guid": 10, "parent_process_guid": 10, "process_disposition": "string", "parent_process_size": 10, "process_size": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_disposition": "string", "type": "ProcessCreateEvent", "parent_process_username": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "parent_creation_time": "2016-01-01T01:01:01Z", "process_args": "string" } ], "registry_delete_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryDeleteEvent", "registry_value": "string" } ], "file_modify_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileModifyEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "registry_set_events": [ { "process_guid": 10, "registry_data": "string", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "RegistrySetEvent", "registry_data_length": 10, "registry_value": "string", "registry_key": "string", "process_name": "string", "process_id": 10, "process_username": "string" } ], "file_create_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileCreateEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "registry_create_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryCreateEvent" } ], "library_load_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "type": "LibraryLoadEvent", "dll_library_name": "string", "dll_library_path": "string" } ], "file_move_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileMoveEvent", "old_name": "string", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "new_name": "string" } ], "file_delete_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileDeleteEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "netflow_events": [ { "parent_process_name": "string", "byte_count_in": 10, "process_guid": 10, "process_path": "string", "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "flow_time": "2016-01-01T01:01:01Z", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_account": "string", "type": "NetflowEvent", "process_account_type": "string", "parent_process_path": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_account": "string", "parent_process_account_type": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "byte_count_out": 10, "process_args": "string" } ], "registry_rename_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryRenameEvent", "registry_old_key": "string" } ] }, "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "sensor": "endpoint", "data": { "columns": [ { "name": "string", "type": "integer", "description": "string", "required": true, "short_description": "string" } ], "rows": [ [ "anything" ] ], "row_count": 10 } } ], "description": "a list of `NewSighting`s." }, "identity_assertions": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "identity-assertion" ], "example": "identity-assertion", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "identity": { "type": "object", "properties": { "observables": { "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." }, "example": [ { "value": "1.2.3.4", "type": "ip" } ] } }, "required": [ "observables" ], "example": { "observables": [ { "value": "1.2.3.4", "type": "ip" } ] }, "description": "Attributes for which the assertion is being made." }, "assertions": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string", "example": "cisco:ctr:ad:host_domain_name", "description": "An open vocabulary containing well known assertion types" }, "value": { "type": "string", "example": "string" } }, "required": [ "name", "value" ], "example": { "name": "cisco:ctr:ad:host_domain_name", "value": "string" } }, "example": [ { "name": "cisco:ctr:ad:host_domain_name", "value": "string" } ], "description": "Any known context about the identity attributes." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid." } }, "required": [ "identity", "assertions" ], "example": { "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "identity": { "observables": [ { "value": "1.2.3.4", "type": "ip" } ] }, "schema_version": "1.3.30", "revision": 10, "type": "identity-assertion", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "assertions": [ { "name": "cisco:ctr:ad:host_domain_name", "value": "string" } ] }, "description": "For submitting a new IdentityAssertion." }, "uniqueItems": true, "example": [ { "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "identity": { "observables": [ { "value": "1.2.3.4", "type": "ip" } ] }, "schema_version": "1.3.30", "revision": 10, "type": "identity-assertion", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "assertions": [ { "name": "cisco:ctr:ad:host_domain_name", "value": "string" } ] } ], "description": "a list of `NewIdentityAssertion`s." }, "target_records": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "target-record" ], "example": "target-record", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "targets": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "endpoint", "description": "The sensor/actuator name that best fits a device." }, "observables": { "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." }, "example": [ { "value": "1.2.3.4", "type": "ip" } ] }, "observed_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "os": { "type": "string", "example": "string", "description": "Source Operating System where TargetRecord was originated." }, "internal": { "type": "boolean", "example": false, "description": "Is it internal to our network?" }, "sensor": { "type": "string", "example": "string", "description": "The OpenC2 Actuator name that best fits the device that is creating this TargetRecord (e.g.: network.firewall, etc.)" }, "source_uri": { "type": "string", "example": "string", "description": "A URI" } }, "required": [ "type", "observables", "observed_time" ], "example": { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "os": "string", "internal": false, "sensor": "string", "source_uri": "string" }, "description": "Schema for TargetRecord Targets" }, "example": [ { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "os": "string", "internal": false, "sensor": "string", "source_uri": "string" } ] } }, "required": [ "source", "targets" ], "example": { "description": "string", "schema_version": "1.3.30", "revision": 10, "type": "target-record", "source": "string", "external_ids": [ "string" ], "targets": [ { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "os": "string", "internal": false, "sensor": "string", "source_uri": "string" } ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z" }, "description": "Schema for submitting new TargetRecord." }, "uniqueItems": true, "example": [ { "description": "string", "schema_version": "1.3.30", "revision": 10, "type": "target-record", "source": "string", "external_ids": [ "string" ], "targets": [ { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "os": "string", "internal": false, "sensor": "string", "source_uri": "string" } ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z" } ], "description": "a list of `NewTargetRecord`s." }, "tools": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "tool" ], "example": "tool", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "labels": { "type": "array", "items": { "type": "string", "example": "credential-exploitation", "description": "Tool labels describe the categories of tools that can be used to perform attacks." }, "example": [ "credential-exploitation" ], "description": "The kind(s) of tool(s) being described." }, "kill_chain_phases": { "type": "array", "items": { "type": "object", "properties": { "kill_chain_name": { "type": "string", "example": "string", "description": "The name of the kill chain." }, "phase_name": { "type": "string", "example": "string", "description": "The name of the phase in the kill chain." } }, "required": [ "kill_chain_name", "phase_name" ], "example": { "kill_chain_name": "string", "phase_name": "string" }, "description": "The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives." }, "example": [ { "kill_chain_name": "string", "phase_name": "string" } ], "description": "The list of kill chain phases for which this Tool can be used." }, "tool_version": { "type": "string", "example": "string", "description": "The version identifier associated with the Tool." }, "x_mitre_aliases": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "example": [ "string" ], "description": "ATT&CK Software.aliases." } }, "required": [ "title", "description", "short_description", "labels" ], "example": { "description": "string", "labels": [ "credential-exploitation" ], "schema_version": "1.3.30", "revision": 10, "type": "tool", "x_mitre_aliases": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tool_version": "string", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "timestamp": "2016-01-01T01:01:01Z" }, "description": "For submitting a new Tool." }, "uniqueItems": true, "example": [ { "description": "string", "labels": [ "credential-exploitation" ], "schema_version": "1.3.30", "revision": 10, "type": "tool", "x_mitre_aliases": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tool_version": "string", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "timestamp": "2016-01-01T01:01:01Z" } ], "description": "a list of `NewTool`s." }, "verdicts": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "verdict" ], "example": "verdict" }, "disposition": { "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Numeric verdict identifiers." }, "observable": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." }, "judgement_id": { "type": "string", "example": "string", "description": "A URI leading to a judgement." }, "disposition_name": { "type": "string", "enum": [ "Clean", "Common", "Malicious", "Suspicious", "Unknown" ], "example": "Clean", "description": "The disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 \"Clean\", 2 \"Malicious\", 3 \"Suspicious\", 4 \"Common\", 5 \"Unknown\"}" }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid." } }, "required": [ "type", "disposition", "observable", "valid_time" ], "example": { "type": "verdict", "disposition": 1, "observable": { "value": "1.2.3.4", "type": "ip" }, "judgement_id": "string", "disposition_name": "Clean", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" } }, "description": "A Verdict is chosen from all of the Judgements on that Observable which have not yet expired. The highest priority Judgement becomes the active verdict. If there is more than one Judgement with that priority, then Clean disposition has priority over all others, then Malicious disposition, and so on down to Unknown.\n\n The ID of a verdict is a a str of the form \"observable.type:observable.value\" for example, \"ip:1.1.1.1\"" }, "uniqueItems": true, "example": [ { "type": "verdict", "disposition": 1, "observable": { "value": "1.2.3.4", "type": "ip" }, "judgement_id": "string", "disposition_name": "Clean", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" } } ], "description": "a list of `Verdict`s." }, "data_tables": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "data-table" ], "example": "data-table", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "columns": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string", "example": "string" }, "type": { "type": "string", "enum": [ "integer", "markdown", "number", "observable", "string", "url" ], "example": "integer" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "required": { "type": "boolean", "example": true, "description": "If `true`, the row entries for this column cannot contain `nulls`. Defaults to `true`." }, "short_description": { "type": "string", "example": "string" } }, "required": [ "name", "type" ], "example": { "name": "string", "type": "integer", "description": "string", "required": true, "short_description": "string" } }, "example": [ { "name": "string", "type": "integer", "description": "string", "required": true, "short_description": "string" } ], "description": "An ordered list of column definitions." }, "rows": { "type": "array", "items": { "type": "array", "items": { "example": "anything" } }, "example": [ [ "anything" ] ], "description": "An ordered list of rows" }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid." }, "row_count": { "type": "integer", "format": "int64", "example": 10, "description": "The number of rows in the data table." } }, "required": [ "columns", "rows" ], "example": { "description": "string", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "columns": [ { "name": "string", "type": "integer", "description": "string", "required": true, "short_description": "string" } ], "type": "data-table", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "rows": [ [ "anything" ] ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "row_count": 10, "timestamp": "2016-01-01T01:01:01Z" }, "description": "Schema for submitting a NewDataTable record." }, "uniqueItems": true, "example": [ { "description": "string", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "columns": [ { "name": "string", "type": "integer", "description": "string", "required": true, "short_description": "string" } ], "type": "data-table", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "rows": [ [ "anything" ] ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "row_count": 10, "timestamp": "2016-01-01T01:01:01Z" } ], "description": "a list of `NewDataTable`s." }, "weaknesses": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "weakness" ], "example": "weakness", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "Should be short and limited to the key points that define this weakness." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "structure": { "type": "string", "enum": [ "Chain", "Composite", "Simple" ], "example": "Chain", "description": "Defines the structural nature of the weakness." }, "languages": { "type": "array", "items": { "type": "object", "properties": { "prevalence": { "type": "string", "enum": [ "Often", "Rarely", "Sometimes", "Undetermined" ], "example": "Often", "description": "Defines the different regularities that guide the applicability of platforms." }, "name": { "type": "string", "example": "string", "description": "Language name (Clojure, Java, ...)" }, "class": { "type": "string", "example": "Assembly", "description": "Class of language." } }, "required": [ "prevalence" ], "example": { "prevalence": "Often", "name": "string", "class": "Assembly" } }, "example": [ { "prevalence": "Often", "name": "string", "class": "Assembly" } ], "description": "Applicable Languages." }, "operating_systems": { "type": "array", "items": { "type": "object", "properties": { "prevalence": { "type": "string", "enum": [ "Often", "Rarely", "Sometimes", "Undetermined" ], "example": "Often", "description": "Defines the different regularities that guide the applicability of platforms." }, "name": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "version": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "cpe_id": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "class": { "type": "string", "example": "Android", "description": "Class of Operating System." } }, "required": [ "prevalence" ], "example": { "prevalence": "Often", "name": "string", "version": "string", "cpe_id": "string", "class": "Android" } }, "example": [ { "prevalence": "Often", "name": "string", "version": "string", "cpe_id": "string", "class": "Android" } ], "description": "Applicable operating systems." }, "architectures": { "type": "array", "items": { "type": "object", "properties": { "prevalence": { "type": "string", "enum": [ "Often", "Rarely", "Sometimes", "Undetermined" ], "example": "Often", "description": "Defines the different regularities that guide the applicability of platforms." }, "name": { "type": "string", "example": "string", "description": "Architecture name (ARM, x86, ...)" }, "class": { "type": "string", "example": "Embedded", "description": "Class of architecture" } }, "required": [ "prevalence" ], "example": { "prevalence": "Often", "name": "string", "class": "Embedded" } }, "example": [ { "prevalence": "Often", "name": "string", "class": "Embedded" } ], "description": "Applicable architectures." }, "paradigms": { "type": "array", "items": { "type": "object", "properties": { "prevalence": { "type": "string", "enum": [ "Often", "Rarely", "Sometimes", "Undetermined" ], "example": "Often", "description": "Defines the different regularities that guide the applicability of platforms." }, "name": { "type": "string", "example": "string", "description": "Paradigm name (Client Server, Mainframe)" } }, "required": [ "prevalence" ], "example": { "prevalence": "Often", "name": "string" } }, "example": [ { "prevalence": "Often", "name": "string" } ], "description": "Applicable paradigms." }, "technologies": { "type": "array", "items": { "type": "object", "properties": { "prevalence": { "type": "string", "enum": [ "Often", "Rarely", "Sometimes", "Undetermined" ], "example": "Often", "description": "Defines the different regularities that guide the applicability of platforms." }, "name": { "type": "string", "example": "string", "description": "Technology name (Web Server, Web Client)" } }, "required": [ "prevalence" ], "example": { "prevalence": "Often", "name": "string" } }, "example": [ { "prevalence": "Often", "name": "string" } ], "description": "Applicable technologies." }, "background_details": { "type": "string", "example": "string", "description": "Information that is relevant but not related to the nature of the weakness itself." }, "alternate_terms": { "type": "array", "items": { "type": "object", "properties": { "term": { "type": "string", "example": "string", "description": "The actual alternate term." }, "description": { "type": "string", "example": "string", "description": "Provides context for the alternate term by which this weakness may be known." } }, "required": [ "term" ], "example": { "term": "string", "description": "string" } }, "example": [ { "term": "string", "description": "string" } ], "description": "Indicates one or more other names used to describe this weakness." }, "modes_of_introduction": { "type": "array", "items": { "type": "object", "properties": { "phase": { "type": "string", "example": "Architecture and Design", "description": "Identifies the point in the software life cycle at which the weakness may be introduced." }, "note": { "type": "string", "example": "string", "description": "Provides a typical scenario related to introduction during the given phase." } }, "required": [ "phase" ], "example": { "phase": "Architecture and Design", "note": "string" } }, "example": [ { "phase": "Architecture and Design", "note": "string" } ], "description": "Information about how and when a given weakness may be introduced." }, "likelihood": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "Likelihood of exploit." }, "common_consequences": { "type": "array", "items": { "type": "object", "properties": { "scopes": { "type": "array", "items": { "type": "string", "example": "Access Control", "description": "Defines the different areas of software security that can be affected by exploiting a weakness." }, "example": [ "Access Control" ], "description": "Identifies the security property that is violated." }, "impacts": { "type": "array", "items": { "type": "string", "example": "Alter Execution Logic" }, "example": [ "Alter Execution Logic" ], "description": "Describes the technical impact that arises if an adversary succeeds in exploiting this weakness." }, "likelihood": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "How likely the specific consequence is expected to be seen relative to the other consequences." }, "note": { "type": "string", "example": "string", "description": "Additional commentary about a consequence." } }, "required": [ "scopes" ], "example": { "scopes": [ "Access Control" ], "impacts": [ "Alter Execution Logic" ], "likelihood": "High", "note": "string" } }, "example": [ { "scopes": [ "Access Control" ], "impacts": [ "Alter Execution Logic" ], "likelihood": "High", "note": "string" } ], "description": "Refers to the typical or expected negative effects that can result from exploiting the weakness. This could include anything from unauthorized access to data, denial of service, system crashes or other things." }, "detection_methods": { "type": "array", "items": { "type": "object", "properties": { "method": { "type": "string", "example": "Architecture or Design Review", "description": "Identifies the particular detection method being described." }, "description": { "type": "string", "example": "string", "description": "Provides some context of how this method can be applied to a specific weakness." }, "effectiveness": { "type": "string", "example": "High", "description": "How effective the detection method may be in detecting the associated weakness." }, "effectiveness_notes": { "type": "string", "example": "string", "description": "Provides additional discussion of the strengths and shortcomings of this detection method." } }, "required": [ "method", "description" ], "example": { "method": "Architecture or Design Review", "description": "string", "effectiveness": "High", "effectiveness_notes": "string" } }, "example": [ { "method": "Architecture or Design Review", "description": "string", "effectiveness": "High", "effectiveness_notes": "string" } ], "description": "Identifies methods that may be employed to detect this weakness, including their strengths and limitations." }, "potential_mitigations": { "type": "array", "items": { "type": "object", "properties": { "description": { "type": "string", "example": "string", "description": "A description of this individual mitigation including any strengths and shortcomings of this mitigation for the weakness." }, "phases": { "type": "array", "items": { "type": "string", "example": "Architecture and Design", "description": "Defines the different regularities that guide the applicability of platforms." }, "example": [ "Architecture and Design" ], "description": "Indicates the development life cycle phase during which this particular mitigation may be applied." }, "strategy": { "type": "string", "example": "Attack Surface Reduction", "description": "A general strategy for protecting a system to which this mitigation contributes." }, "effectiveness": { "type": "string", "example": "Defense in Depth", "description": "Summarizes how effective the mitigation may be in preventing the weakness." }, "effectiveness_notes": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." } }, "required": [ "description" ], "example": { "description": "string", "phases": [ "Architecture and Design" ], "strategy": "Attack Surface Reduction", "effectiveness": "Defense in Depth", "effectiveness_notes": "string" } }, "example": [ { "description": "string", "phases": [ "Architecture and Design" ], "strategy": "Attack Surface Reduction", "effectiveness": "Defense in Depth", "effectiveness_notes": "string" } ], "description": "Describes potential mitigations associated with a weakness." }, "functional_areas": { "type": "array", "items": { "type": "string", "example": "Authentication", "description": "Defines the different functional areas of software in which the weakness may appear." }, "example": [ "Authentication" ], "description": "Identifies the functional area of the software in which the weakness is most likely to occur." }, "affected_resources": { "type": "array", "items": { "type": "string", "example": "CPU", "description": "Defines a resource of a system." }, "example": [ "CPU" ], "description": "Identifies system resources that can be affected by an exploit of this weakness." }, "notes": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "Applicable Platform", "description": "Defines the different types of notes that can be associated with a weakness." }, "note": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." } }, "required": [ "type", "note" ], "example": { "type": "Applicable Platform", "note": "string" } }, "example": [ { "type": "Applicable Platform", "note": "string" } ], "description": "Provides any additional comments about the weakness." }, "abstraction_level": { "type": "string", "enum": [ "Base", "Class", "Compound", "Variant" ], "example": "Base", "description": "Refers to the level of abstraction or granularity used to describe the weakness. It helps to categorize the vulnerability based on the level of detail provided." } }, "required": [ "description" ], "example": { "description": "string", "background_details": "string", "paradigms": [ { "prevalence": "Often", "name": "string" } ], "abstraction_level": "Base", "architectures": [ { "prevalence": "Often", "name": "string", "class": "Embedded" } ], "schema_version": "1.3.30", "revision": 10, "alternate_terms": [ { "term": "string", "description": "string" } ], "likelihood": "High", "type": "weakness", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "functional_areas": [ "Authentication" ], "source_uri": "string", "modes_of_introduction": [ { "phase": "Architecture and Design", "note": "string" } ], "structure": "Chain", "language": "string", "id": "string", "notes": [ { "type": "Applicable Platform", "note": "string" } ], "common_consequences": [ { "scopes": [ "Access Control" ], "impacts": [ "Alter Execution Logic" ], "likelihood": "High", "note": "string" } ], "tlp": "green", "detection_methods": [ { "method": "Architecture or Design Review", "description": "string", "effectiveness": "High", "effectiveness_notes": "string" } ], "operating_systems": [ { "prevalence": "Often", "name": "string", "version": "string", "cpe_id": "string", "class": "Android" } ], "affected_resources": [ "CPU" ], "languages": [ { "prevalence": "Often", "name": "string", "class": "Assembly" } ], "timestamp": "2016-01-01T01:01:01Z", "potential_mitigations": [ { "description": "string", "phases": [ "Architecture and Design" ], "strategy": "Attack Surface Reduction", "effectiveness": "Defense in Depth", "effectiveness_notes": "string" } ], "technologies": [ { "prevalence": "Often", "name": "string" } ] }, "description": "For submitting a new weakness." }, "uniqueItems": true, "example": [ { "description": "string", "background_details": "string", "paradigms": [ { "prevalence": "Often", "name": "string" } ], "abstraction_level": "Base", "architectures": [ { "prevalence": "Often", "name": "string", "class": "Embedded" } ], "schema_version": "1.3.30", "revision": 10, "alternate_terms": [ { "term": "string", "description": "string" } ], "likelihood": "High", "type": "weakness", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "functional_areas": [ "Authentication" ], "source_uri": "string", "modes_of_introduction": [ { "phase": "Architecture and Design", "note": "string" } ], "structure": "Chain", "language": "string", "id": "string", "notes": [ { "type": "Applicable Platform", "note": "string" } ], "common_consequences": [ { "scopes": [ "Access Control" ], "impacts": [ "Alter Execution Logic" ], "likelihood": "High", "note": "string" } ], "tlp": "green", "detection_methods": [ { "method": "Architecture or Design Review", "description": "string", "effectiveness": "High", "effectiveness_notes": "string" } ], "operating_systems": [ { "prevalence": "Often", "name": "string", "version": "string", "cpe_id": "string", "class": "Android" } ], "affected_resources": [ "CPU" ], "languages": [ { "prevalence": "Often", "name": "string", "class": "Assembly" } ], "timestamp": "2016-01-01T01:01:01Z", "potential_mitigations": [ { "description": "string", "phases": [ "Architecture and Design" ], "strategy": "Attack Surface Reduction", "effectiveness": "Defense in Depth", "effectiveness_notes": "string" } ], "technologies": [ { "prevalence": "Often", "name": "string" } ] } ], "description": "a list of `NewWeakness`s." }, "vulnerabilities": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "vulnerability" ], "example": "vulnerability", "description": "A valid entity type identifer" }, "schema_version": { "type": "string", "enum": [ "1.3.30" ], "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "example": "string", "description": "Various sources of vulnerability information can be used, including third-party resources like the National Vulnerability Database (NVD) and the Common Vulnerabilities and Exposures (CVE) database. The platform then analyzes this data and provides the user with relevant details such as the severity of the vulnerability, the affected systems, and remediation recommendations. \n\n Based on this information, the user can prioritize patching and other mitigation strategies to reduce the risk of potential attacks." }, "short_description": { "type": "string", "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "cve": { "type": "object", "properties": { "cve_data_meta": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "assigner": { "type": "string", "example": "string", "description": "String with at most 1024 characters." } }, "example": { "id": "string", "assigner": "string" } } }, "required": [ "cve_data_meta" ], "example": { "cve_data_meta": { "id": "string", "assigner": "string" } } }, "impact": { "type": "object", "properties": { "cvss_v2": { "type": "object", "properties": { "vector_string": { "type": "string", "example": "string", "description": "a text representation of a set of CVSSv2 metrics. It is commonly used to record or transfer CVSSv2 metric information in a concise form" }, "base_score": { "type": "number", "format": "double", "example": 10.0, "description": "The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v2/guide" }, "base_severity": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "impact_score": { "type": "number", "format": "double", "example": 10.0, "description": "a Score number from 0 to 10" }, "exploitability_score": { "type": "number", "format": "double", "example": 10.0, "description": "a Score number from 0 to 10" }, "access_vector": { "type": "string", "enum": [ "adjacent network", "local", "network" ], "example": "network", "description": "This metric reflects how the vulnerability is exploited.The more remote an attacker can be to attack a host, the greater the vulnerability score." }, "access_complexity": { "type": "string", "enum": [ "high", "low", "medium" ], "example": "low", "description": "This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system. For example, consider a buffer overflow in an Internet service: once the target system is located, the attacker can launch an exploit at will." }, "authentication": { "type": "string", "enum": [ "multiple", "none", "single" ], "example": "none", "description": "This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. This metric does not gauge the strength or complexity of the authentication process, only that an attacker is required to provide credentials before an exploit may occur. The fewer authentication instances that are required, the higher the vulnerability score." }, "confidentiality_impact": { "type": "string", "enum": [ "complete", "none", "partial" ], "example": "complete", "description": "This metric measures the impact on confidentiality of a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. Increasedconfidentiality impact increases the vulnerability score." }, "integrity_impact": { "type": "string", "enum": [ "complete", "none", "partial" ], "example": "complete", "description": "This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information. Increased integrity impact increases the vulnerability score." }, "availability_impact": { "type": "string", "enum": [ "complete", "none", "partial" ], "example": "complete", "description": "This metric measures the impact to availability of a successfully exploited vulnerability. Availability refers to the accessibility of information resources. Attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system. Increased availability impact increases the vulnerability score." }, "exploitability": { "type": "string", "enum": [ "functional", "high", "not_defined", "proof_of_concept", "unproven" ], "example": "not_defined", "description": "This metric measures the current state of exploit techniques or code availability. Public availability of easy-to-use exploit code increases the number of potential attackers by including those who are unskilled thereby increasing the severity of the vulnerability." }, "remediation_level": { "type": "string", "enum": [ "not_defined", "official_fix", "temporary_fix", "unavailable", "workaround" ], "example": "not_defined", "description": "The remediation level of a vulnerability is an important factor for prioritization. The typical vulnerability is unpatched when initially published. Workarounds or hotfixes may offer interim remediation until an official patch or upgrade is issued. Each of these respective stages adjusts the temporal score downwards, reflecting the decreasing urgency as remediation becomes final. The less official and permanent a fix, the higher the vulnerability score is." }, "report_confidence": { "type": "string", "enum": [ "confirmed", "not_defined", "unconfirmed", "uncorroborated" ], "example": "not_defined", "description": "This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details. Sometimes, only the existence of vulnerabilities are publicized, but without specific details. The vulnerability may later be corroborated and then confirmed through acknowledgement by the author or vendor of the affected technology. The urgency of a vulnerability is higher when a vulnerability is known to exist with certainty. This metric also suggests the level of technical knowledge available to would-be attackers. The more a vulnerability is validated by the vendor or other reputable sources, the higher the score." }, "temporal_vector_string": { "type": "string", "example": "string", "description": "A text representation of a set of CVSSv2 temporal metrics. Temporal metrics allow analysists to calculate threat severity based on temporal factors such as reliability of vulnerability reports, availability of mitigations, and the ease or difficulty of conducting the exploit. It is commonly used to record or transfer CVSSv2 metric information in a concise form" }, "collateral_damage_potential": { "type": "string", "enum": [ "high", "low", "low_medium", "medium_high", "none", "not_defined" ], "example": "not_defined", "description": "This metric measures the potential for loss of life or physical assets through damage or theft of property or equipment. The metric may also measure economic loss of productivity or revenue. Naturally, the greater the damage potential, the higher the vulnerability score." }, "target_distribution": { "type": "string", "enum": [ "high", "low", "medium", "none", "not_defined" ], "example": "not_defined", "description": "This metric measures the proportion of vulnerable systems. It is meant as an environment-specific indicator in order to approximate the percentage of systems that could be affected by the vulnerability. The greater the proportion of vulnerable systems, the higher the score." }, "confidentiality_requirement": { "type": "string", "enum": [ "high", "low", "medium", "not_defined" ], "example": "not_defined", "description": "These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high." }, "integrity_requirement": { "type": "string", "enum": [ "high", "low", "medium", "not_defined" ], "example": "not_defined", "description": "These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high." }, "availability_requirement": { "type": "string", "enum": [ "high", "low", "medium", "not_defined" ], "example": "not_defined", "description": "These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a users organization, measured in terms of confidentiality, integrity, and availability, That is, if an IT asset supports a business function for which availability is most important, the analyst can assign a greater value to availability, relative to confidentiality and integrity. Each security requirement has three possible values: low, medium, or high." }, "environmental_vector_string": { "type": "string", "example": "string", "description": "A text representation of a set of CVSSv2 environmental metrics. Environmental metrics allow analysists to calculate threat scores in relation to environmental security requirements, collateral damage potential, and target availability. It is commonly used to record or transfer CVSSv2 metric information in a concise form" }, "obtain_all_privilege": { "type": "boolean", "example": true }, "obtain_user_privilege": { "type": "boolean", "example": true }, "obtain_other_privilege": { "type": "boolean", "example": true }, "user_interaction_required": { "type": "boolean", "example": true } }, "required": [ "vector_string", "base_score", "base_severity" ], "example": { "integrity_impact": "complete", "target_distribution": "not_defined", "availability_requirement": "not_defined", "exploitability": "not_defined", "access_complexity": "low", "temporal_vector_string": "string", "exploitability_score": 10.0, "impact_score": 10.0, "user_interaction_required": true, "environmental_vector_string": "string", "obtain_other_privilege": true, "availability_impact": "complete", "access_vector": "network", "base_severity": "High", "confidentiality_impact": "complete", "confidentiality_requirement": "not_defined", "report_confidence": "not_defined", "authentication": "none", "base_score": 10.0, "obtain_user_privilege": true, "obtain_all_privilege": true, "collateral_damage_potential": "not_defined", "remediation_level": "not_defined", "vector_string": "string", "integrity_requirement": "not_defined" } }, "cvss_v3": { "type": "object", "properties": { "vector_string": { "type": "string", "example": "string", "description": "a text representation of a set of CVSSv3 metrics. It is commonly used to record or transfer CVSSv3 metric information in a concise form" }, "base_score": { "type": "number", "format": "double", "example": 10.0, "description": "The base score is a key metric in CVSS, which uses a scoring system to determine the level of severity of a vulnerability. see: https://www.first.org/cvss/v3-1" }, "base_severity": { "type": "string", "enum": [ "critical", "high", "low", "medium", "none" ], "example": "critical" }, "impact_score": { "type": "number", "format": "double", "example": 10.0, "description": "a Score number from 0 to 10" }, "exploitability_score": { "type": "number", "format": "double", "example": 10.0, "description": "a Score number from 0 to 10" }, "attack_vector": { "type": "string", "enum": [ "adjacent_network", "local", "network", "physical" ], "example": "adjacent_network", "description": "Reflects the context by which vulnerability exploitation is possible" }, "modified_attack_vector": { "type": "string", "enum": [ "adjacent_network", "local", "network", "not_defined", "physical" ], "example": "not_defined", "description": "modified attack vector" }, "attack_complexity": { "type": "string", "enum": [ "high", "low" ], "example": "high", "description": "describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability" }, "modified_attack_complexity": { "type": "string", "enum": [ "high", "low", "not_defined" ], "example": "not_defined", "description": "modified attack complexity" }, "privileges_required": { "type": "string", "enum": [ "high", "low", "none" ], "example": "high", "description": "describes the level of privileges an attacker must possess before successfully exploiting the vulnerability" }, "modified_privileges_required": { "type": "string", "enum": [ "high", "low", "none", "not_defined" ], "example": "not_defined", "description": "modified privileges required" }, "user_interaction": { "type": "string", "enum": [ "none", "required" ], "example": "none", "description": "captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component" }, "modified_user_interaction": { "type": "string", "enum": [ "none", "not_defined", "required" ], "example": "none", "description": "modified user interaction" }, "scope": { "type": "string", "enum": [ "changed", "unchanged" ], "example": "changed", "description": "the ability for a vulnerability in one software component to impact resources beyond its means, or privileges" }, "modified_scope": { "type": "string", "enum": [ "changed", "not_defined", "unchanged" ], "example": "not_defined", "description": "modified scope" }, "confidentiality_impact": { "type": "string", "enum": [ "high", "low", "none" ], "example": "high", "description": "measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability" }, "modified_confidentiality_impact": { "type": "string", "enum": [ "high", "low", "none", "not_defined" ], "example": "not_defined", "description": "modified confidentiality impact" }, "integrity_impact": { "type": "string", "enum": [ "high", "low", "none" ], "example": "high", "description": "measures the impact to integrity of a successfully exploited vulnerability" }, "modified_integrity_impact": { "type": "string", "enum": [ "high", "low", "none", "not_defined" ], "example": "not_defined", "description": "modified integrity impact" }, "availability_impact": { "type": "string", "enum": [ "high", "low", "none" ], "example": "high", "description": "measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability" }, "modified_availability_impact": { "type": "string", "enum": [ "high", "low", "none", "not_defined" ], "example": "not_defined", "description": "modified availability impact" }, "exploit_code_maturity": { "type": "string", "enum": [ "functional", "high", "not_defined", "proof_of_concept", "unproven" ], "example": "functional", "description": "measures the likelihood of the vulnerability being attacked" }, "remediation_level": { "type": "string", "enum": [ "high", "not_defined", "offical_fix", "temporary_fix", "unavailable", "workaround" ], "example": "high", "description": "Remediation Level of a vulnerability is an important factor for prioritization" }, "report_confidence": { "type": "string", "enum": [ "confirmed", "reasonable", "unknown" ], "example": "confirmed", "description": "measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details" }, "temporal_score": { "type": "number", "format": "double", "example": 10.0, "description": "Round up(CVSSv3BaseScore \u00d7 CVSSv3ExploitCodeMaturity \u00d7 CVSSv3RemediationLevel \u00d7 CVSSv3ReportConfidence)" }, "temporal_severity": { "type": "string", "enum": [ "critical", "high", "low", "medium", "none" ], "example": "critical", "description": "temporal severity" }, "availability_requirement": { "type": "string", "enum": [ "high", "low", "none", "not_defined" ], "example": "high", "description": "These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user's organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default)." }, "confidentiality_requirement": { "type": "string", "enum": [ "high", "low", "none", "not_defined" ], "example": "high", "description": "These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user's organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default)." }, "integrity_requirement": { "type": "string", "enum": [ "high", "low", "none", "not_defined" ], "example": "high", "description": "These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user's organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability relative to Confidentiality and Integrity. Each security requirement has three possible values: Low, Medium, or High. The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. That is, these metrics modify the environmental score by reweighting the Modified Confidentiality, Integrity, and Availability impact metrics. For example, the Modified Confidentialityimpact (MC) metric has increased weight if the Confidentiality Requirement (CR) is High. Likewise, the Modified Confidentiality impact metric has decreased weight if the Confidentiality Requirement is Low. The Modified Confidentiality impact metric weighting is neutral if the Confidentiality Requirement is Medium. This same process is applied to the Integrity and Availability requirements.Note that the Confidentiality Requirement will not affect the Environmental score if the (Modified Base) confidentiality impact is set to None. Also, increasing the Confidentiality Requirement from Medium to Highwill not change the Environmental score when the (Modified Base) impact metrics are set to High. This is because the modified impact sub score (part of the Modified Base score that calculates impact) is already at a maximum value of 10. The list of possible values is: `not_defined`: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. `high`: Loss of [Confidentiality / Integrity / Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). `medium`: Loss of [Confidentiality / Integrity / Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).`low`: Loss of [Confidentiality / Integrity / Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers). For brevity, the same table is used for all three metrics. The greater the Security Requirement, the higher the score (recall that Medium is considered the default)." }, "environmental_score": { "type": "number", "format": "double", "example": 10.0, "description": "a Score number from 0 to 10" }, "environmental_severity": { "type": "string", "enum": [ "critical", "high", "low", "medium", "none" ], "example": "critical" } }, "required": [ "vector_string", "base_score", "base_severity" ], "example": { "integrity_impact": "high", "modified_user_interaction": "none", "modified_scope": "not_defined", "availability_requirement": "high", "user_interaction": "none", "modified_integrity_impact": "not_defined", "privileges_required": "high", "exploitability_score": 10.0, "impact_score": 10.0, "environmental_severity": "critical", "modified_availability_impact": "not_defined", "availability_impact": "high", "scope": "changed", "exploit_code_maturity": "functional", "modified_attack_complexity": "not_defined", "base_severity": "critical", "confidentiality_impact": "high", "temporal_severity": "critical", "modified_confidentiality_impact": "not_defined", "confidentiality_requirement": "high", "report_confidence": "confirmed", "temporal_score": 10.0, "modified_privileges_required": "not_defined", "modified_attack_vector": "not_defined", "base_score": 10.0, "environmental_score": 10.0, "remediation_level": "high", "vector_string": "string", "integrity_requirement": "high", "attack_vector": "adjacent_network", "attack_complexity": "high" } } }, "example": { "cvss_v2": { "integrity_impact": "complete", "target_distribution": "not_defined", "availability_requirement": "not_defined", "exploitability": "not_defined", "access_complexity": "low", "temporal_vector_string": "string", "exploitability_score": 10.0, "impact_score": 10.0, "user_interaction_required": true, "environmental_vector_string": "string", "obtain_other_privilege": true, "availability_impact": "complete", "access_vector": "network", "base_severity": "High", "confidentiality_impact": "complete", "confidentiality_requirement": "not_defined", "report_confidence": "not_defined", "authentication": "none", "base_score": 10.0, "obtain_user_privilege": true, "obtain_all_privilege": true, "collateral_damage_potential": "not_defined", "remediation_level": "not_defined", "vector_string": "string", "integrity_requirement": "not_defined" }, "cvss_v3": { "integrity_impact": "high", "modified_user_interaction": "none", "modified_scope": "not_defined", "availability_requirement": "high", "user_interaction": "none", "modified_integrity_impact": "not_defined", "privileges_required": "high", "exploitability_score": 10.0, "impact_score": 10.0, "environmental_severity": "critical", "modified_availability_impact": "not_defined", "availability_impact": "high", "scope": "changed", "exploit_code_maturity": "functional", "modified_attack_complexity": "not_defined", "base_severity": "critical", "confidentiality_impact": "high", "temporal_severity": "critical", "modified_confidentiality_impact": "not_defined", "confidentiality_requirement": "high", "report_confidence": "confirmed", "temporal_score": 10.0, "modified_privileges_required": "not_defined", "modified_attack_vector": "not_defined", "base_score": 10.0, "environmental_score": 10.0, "remediation_level": "high", "vector_string": "string", "integrity_requirement": "high", "attack_vector": "adjacent_network", "attack_complexity": "high" } }, "description": "Describes the potential impact of a vulnerability that is being tracked in the system. Provides information on the extent of damage that a vulnerability can cause and how serious the consequences could be if it is exploited. \n\nMay contain granular information about the vulnerability severity using the CVSS system, versions 2 and 3.\n\nCVSSv2 and CVSSv3 have different methods of calculating base scores, but both are designed to provide an indication of the level of risk that a vulnerability poses. The base score ranges from 0 to 10, with 10 being the most severe. Additionally, both CVSSv2 and CVSSv3 define severity levels, such as low, medium, high, and critical, based on the base score." }, "configurations": { "type": "object", "properties": { "CVE_data_version": { "type": "string", "example": "string", "description": "Specifies the version of the CVE (Common Vulnerabilities and Exposures) dictionary used by the vulnerability information provider." }, "nodes": { "type": "array", "items": { "type": "object", "properties": { "operator": { "type": "string", "enum": [ "AND", "OR" ], "example": "AND", "description": "The operator string influences how seqs of cpe matches are related to one another." }, "cpe_match": { "type": "array", "items": { "type": "object", "properties": { "vulnerable": { "type": "boolean", "example": true }, "cpe23Uri": { "type": "string", "example": "string", "description": "A text representation of a software or hardware platform." }, "versionStartIncluding": { "type": "string", "example": "string", "description": "A string representing the lower bound(inclusive) of version in the CPE." }, "versionEndIncluding": { "type": "string", "example": "string", "description": "A string representing the upper bound(inclusive) of version in the CPE." }, "versionStartExcluding": { "type": "string", "example": "string", "description": "A string representing the lower bound(exclusive) of version in the CPE." }, "versionEndExcluding": { "type": "string", "example": "string", "description": "A string representing the upper bound(exclusive) of version in the CPE." } }, "required": [ "vulnerable", "cpe23Uri" ], "example": { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } }, "example": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ] }, "children": { "type": "array", "items": { "type": "object", "properties": { "operator": { "type": "string", "enum": [ "AND", "OR" ], "example": "AND", "description": "The operator string influences how seqs of cpe matches are related to one another." }, "cpe_match": { "type": "array", "items": { "type": "object", "properties": { "vulnerable": { "type": "boolean", "example": true }, "cpe23Uri": { "type": "string", "example": "string", "description": "A text representation of a software or hardware platform." }, "versionStartIncluding": { "type": "string", "example": "string", "description": "A string representing the lower bound(inclusive) of version in the CPE." }, "versionEndIncluding": { "type": "string", "example": "string", "description": "A string representing the upper bound(inclusive) of version in the CPE." }, "versionStartExcluding": { "type": "string", "example": "string", "description": "A string representing the lower bound(exclusive) of version in the CPE." }, "versionEndExcluding": { "type": "string", "example": "string", "description": "A string representing the upper bound(exclusive) of version in the CPE." } }, "required": [ "vulnerable", "cpe23Uri" ], "example": { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } }, "example": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ] }, "negate": { "type": "boolean", "example": true, "description": "Negates operator when true." } }, "required": [ "operator", "cpe_match" ], "example": { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "negate": true } }, "example": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "negate": true } ] }, "negate": { "type": "boolean", "example": true, "description": "Negates operator when true." } }, "required": [ "operator" ], "example": { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "children": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "negate": true } ], "negate": true } }, "example": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "children": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "negate": true } ], "negate": true } ], "description": "Each `node` in the CTIM standard configuration includes information such as the `operator` (such as \"less than\", or \"greater than or equal to\"), and the `cpe` (Common Platform Enumeration) string which identifies the specific software, `CPE` is a structured naming scheme for IT systems, platforms, and software packages, and it is instrumental in enabling data exchange between different systems." } }, "required": [ "CVE_data_version", "nodes" ], "example": { "CVE_data_version": "string", "nodes": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "children": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "negate": true } ], "negate": true } ] }, "description": "Represents a list of affected versions or configurations of a software component that is impacted by a vulnerability. \nBy tracking the affected software components and versions, defenders can identify which systems are potentially exposed to an attack, and apply appropriate mitigations." }, "published_date": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Represents the date when a vulnerability was publicly disclosed or made available to the general public. \n\nImportant for tracking the age of a vulnerability, as well as for determining when a particular vulnerability was first introduced into a system. The published date can be used to identify the time window during which a system may have been vulnerable to a particular exploit.\n\nFor example, if an organization discovers that a vulnerability was published before their system's installation date, but they did not apply the necessary security updates in a timely manner, it can be concluded that their system was vulnerable for the period between the installation date and the date when the necessary security updates were applied." }, "last_modified_date": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Represents the date when the vulnerability metadata was last updated in the internal database.\nIt can be used to track the freshness of the vulnerability information. If the `last_modified_date` is more recent than the `published_date`, it can indicate that there has been some new information or updates related to the vulnerability, such as new patch releases or changes in the severity or impact rating." } }, "required": [ "description" ], "example": { "description": "string", "schema_version": "1.3.30", "revision": 10, "published_date": "2016-01-01T01:01:01Z", "cve": { "cve_data_meta": { "id": "string", "assigner": "string" } }, "configurations": { "CVE_data_version": "string", "nodes": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "children": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "negate": true } ], "negate": true } ] }, "type": "vulnerability", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "last_modified_date": "2016-01-01T01:01:01Z", "impact": { "cvss_v2": { "integrity_impact": "complete", "target_distribution": "not_defined", "availability_requirement": "not_defined", "exploitability": "not_defined", "access_complexity": "low", "temporal_vector_string": "string", "exploitability_score": 10.0, "impact_score": 10.0, "user_interaction_required": true, "environmental_vector_string": "string", "obtain_other_privilege": true, "availability_impact": "complete", "access_vector": "network", "base_severity": "High", "confidentiality_impact": "complete", "confidentiality_requirement": "not_defined", "report_confidence": "not_defined", "authentication": "none", "base_score": 10.0, "obtain_user_privilege": true, "obtain_all_privilege": true, "collateral_damage_potential": "not_defined", "remediation_level": "not_defined", "vector_string": "string", "integrity_requirement": "not_defined" }, "cvss_v3": { "integrity_impact": "high", "modified_user_interaction": "none", "modified_scope": "not_defined", "availability_requirement": "high", "user_interaction": "none", "modified_integrity_impact": "not_defined", "privileges_required": "high", "exploitability_score": 10.0, "impact_score": 10.0, "environmental_severity": "critical", "modified_availability_impact": "not_defined", "availability_impact": "high", "scope": "changed", "exploit_code_maturity": "functional", "modified_attack_complexity": "not_defined", "base_severity": "critical", "confidentiality_impact": "high", "temporal_severity": "critical", "modified_confidentiality_impact": "not_defined", "confidentiality_requirement": "high", "report_confidence": "confirmed", "temporal_score": 10.0, "modified_privileges_required": "not_defined", "modified_attack_vector": "not_defined", "base_score": 10.0, "environmental_score": 10.0, "remediation_level": "high", "vector_string": "string", "integrity_requirement": "high", "attack_vector": "adjacent_network", "attack_complexity": "high" } } }, "description": "For submitting a new vulnerability." }, "uniqueItems": true, "example": [ { "description": "string", "schema_version": "1.3.30", "revision": 10, "published_date": "2016-01-01T01:01:01Z", "cve": { "cve_data_meta": { "id": "string", "assigner": "string" } }, "configurations": { "CVE_data_version": "string", "nodes": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "children": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "negate": true } ], "negate": true } ] }, "type": "vulnerability", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "last_modified_date": "2016-01-01T01:01:01Z", "impact": { "cvss_v2": { "integrity_impact": "complete", "target_distribution": "not_defined", "availability_requirement": "not_defined", "exploitability": "not_defined", "access_complexity": "low", "temporal_vector_string": "string", "exploitability_score": 10.0, "impact_score": 10.0, "user_interaction_required": true, "environmental_vector_string": "string", "obtain_other_privilege": true, "availability_impact": "complete", "access_vector": "network", "base_severity": "High", "confidentiality_impact": "complete", "confidentiality_requirement": "not_defined", "report_confidence": "not_defined", "authentication": "none", "base_score": 10.0, "obtain_user_privilege": true, "obtain_all_privilege": true, "collateral_damage_potential": "not_defined", "remediation_level": "not_defined", "vector_string": "string", "integrity_requirement": "not_defined" }, "cvss_v3": { "integrity_impact": "high", "modified_user_interaction": "none", "modified_scope": "not_defined", "availability_requirement": "high", "user_interaction": "none", "modified_integrity_impact": "not_defined", "privileges_required": "high", "exploitability_score": 10.0, "impact_score": 10.0, "environmental_severity": "critical", "modified_availability_impact": "not_defined", "availability_impact": "high", "scope": "changed", "exploit_code_maturity": "functional", "modified_attack_complexity": "not_defined", "base_severity": "critical", "confidentiality_impact": "high", "temporal_severity": "critical", "modified_confidentiality_impact": "not_defined", "confidentiality_requirement": "high", "report_confidence": "confirmed", "temporal_score": 10.0, "modified_privileges_required": "not_defined", "modified_attack_vector": "not_defined", "base_score": 10.0, "environmental_score": 10.0, "remediation_level": "high", "vector_string": "string", "integrity_requirement": "high", "attack_vector": "adjacent_network", "attack_complexity": "high" } } } ], "description": "a list of `NewVulnerability`s." }, "actor_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "asset_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "asset_mapping_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "asset_properties_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "attack_pattern_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "campaign_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "coa_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "feedback_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "identity_assertion_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "incident_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "indicator_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "judgement_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "malware_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "note_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "relationship_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "sighting_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "target_record_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "tool_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "verdict_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "data_table_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "weakness_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "vulnerability_refs": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an entity." }, "uniqueItems": true, "example": [ "string" ] }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid." } }, "required": [ "source" ], "example": { "description": "string", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "asset_mapping_refs": [ "string" ], "note_refs": [ "string" ], "data_table_refs": [ "string" ], "attack_pattern_refs": [ "string" ], "sighting_refs": [ "string" ], "schema_version": "1.3.30", "revision": 10, "assets": [ { "description": "string", "asset_type": "application", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "type": "asset", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z" } ], "weakness_refs": [ "string" ], "tool_refs": [ "string" ], "target_record_refs": [ "string" ], "asset_refs": [ "string" ], "tools": [ { "description": "string", "labels": [ "credential-exploitation" ], "schema_version": "1.3.30", "revision": 10, "type": "tool", "x_mitre_aliases": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tool_version": "string", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "timestamp": "2016-01-01T01:01:01Z" } ], "indicators": [ { "description": "string", "tags": [ "string" ], "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "producer": "string", "schema_version": "1.3.30", "revision": 10, "type": "indicator", "test_mechanisms": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "composite_indicator_expression": { "operator": "and", "indicator_ids": [ "string" ] }, "title": "string", "likely_impact": "string", "indicator_type": [ "Anonymization" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "severity": "Critical", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "negate": true, "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "specification": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } } ], "attack_patterns": [ { "description": "string", "abstraction_level": "aggregate", "schema_version": "1.3.30", "revision": 10, "type": "attack-pattern", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "x_mitre_platforms": [ "string" ], "language": "string", "id": "string", "tlp": "green", "x_mitre_data_sources": [ "string" ], "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "x_mitre_contributors": [ "string" ], "timestamp": "2016-01-01T01:01:01Z" } ], "type": "bundle", "weaknesses": [ { "description": "string", "background_details": "string", "paradigms": [ { "prevalence": "Often", "name": "string" } ], "abstraction_level": "Base", "architectures": [ { "prevalence": "Often", "name": "string", "class": "Embedded" } ], "schema_version": "1.3.30", "revision": 10, "alternate_terms": [ { "term": "string", "description": "string" } ], "likelihood": "High", "type": "weakness", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "functional_areas": [ "Authentication" ], "source_uri": "string", "modes_of_introduction": [ { "phase": "Architecture and Design", "note": "string" } ], "structure": "Chain", "language": "string", "id": "string", "notes": [ { "type": "Applicable Platform", "note": "string" } ], "common_consequences": [ { "scopes": [ "Access Control" ], "impacts": [ "Alter Execution Logic" ], "likelihood": "High", "note": "string" } ], "tlp": "green", "detection_methods": [ { "method": "Architecture or Design Review", "description": "string", "effectiveness": "High", "effectiveness_notes": "string" } ], "operating_systems": [ { "prevalence": "Often", "name": "string", "version": "string", "cpe_id": "string", "class": "Android" } ], "affected_resources": [ "CPU" ], "languages": [ { "prevalence": "Often", "name": "string", "class": "Assembly" } ], "timestamp": "2016-01-01T01:01:01Z", "potential_mitigations": [ { "description": "string", "phases": [ "Architecture and Design" ], "strategy": "Attack Surface Reduction", "effectiveness": "Defense in Depth", "effectiveness_notes": "string" } ], "technologies": [ { "prevalence": "Often", "name": "string" } ] } ], "source": "string", "external_ids": [ "string" ], "feedback_refs": [ "string" ], "asset_properties": [ { "properties": [ { "name": "string", "value": "string" } ], "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "asset_ref": "string", "type": "asset-properties", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z" } ], "short_description": "string", "feedbacks": [ { "feedback": -1, "schema_version": "1.3.30", "revision": 10, "type": "feedback", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "reason": "string", "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "entity_id": "string", "timestamp": "2016-01-01T01:01:01Z" } ], "judgement_refs": [ "string" ], "title": "string", "coa_refs": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "verdicts": [ { "type": "verdict", "disposition": 1, "observable": { "value": "1.2.3.4", "type": "ip" }, "judgement_id": "string", "disposition_name": "Clean", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" } } ], "campaigns": [ { "description": "string", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "type": "campaign", "campaign_type": "string", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "activity": [ { "date_time": "2016-01-01T01:01:01Z", "description": "string" } ], "source_uri": "string", "intended_effect": [ "Account Takeover" ], "status": "Future", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "names": [ "string" ] } ], "source_uri": "string", "actors": [ { "description": "string", "motivation": "Ego", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "identity": { "description": "string", "related_identities": [ { "identity": "string", "confidence": "High", "information_source": "string", "relationship": "string" } ] }, "sophistication": "Aspirant", "schema_version": "1.3.30", "revision": 10, "planning_and_operational_support": "string", "type": "actor", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "intended_effect": "Account Takeover", "language": "string", "id": "string", "tlp": "green", "aliases": [ "string" ], "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "actor_types": [ "Cyber Espionage Operations" ] } ], "indicator_refs": [ "string" ], "actor_refs": [ "string" ], "language": "string", "data_tables": [ { "description": "string", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "columns": [ { "name": "string", "type": "integer", "description": "string", "required": true, "short_description": "string" } ], "type": "data-table", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "rows": [ [ "anything" ] ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "row_count": 10, "timestamp": "2016-01-01T01:01:01Z" } ], "id": "string", "notes": [ { "schema_version": "1.3.30", "revision": 10, "content": "string", "note_class": "keyword", "type": "note", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "author": "string", "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "related_entities": [ { "entity_type": "string", "entity_id": "string" } ] } ], "identity_assertions": [ { "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "identity": { "observables": [ { "value": "1.2.3.4", "type": "ip" } ] }, "schema_version": "1.3.30", "revision": 10, "type": "identity-assertion", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "assertions": [ { "name": "cisco:ctr:ad:host_domain_name", "value": "string" } ] } ], "judgements": [ { "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "schema_version": "1.3.30", "revision": 10, "observable": { "value": "1.2.3.4", "type": "ip" }, "reason_uri": "string", "type": "judgement", "source": "string", "external_ids": [ "string" ], "disposition": 1, "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "reason": "string", "source_uri": "string", "disposition_name": "Clean", "priority": 10, "language": "string", "id": "string", "severity": "Critical", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "confidence": "High" } ], "malwares": [ { "description": "string", "labels": [ "adware" ], "abstraction_level": "family", "schema_version": "1.3.30", "revision": 10, "type": "malware", "x_mitre_aliases": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "timestamp": "2016-01-01T01:01:01Z" } ], "target_records": [ { "description": "string", "schema_version": "1.3.30", "revision": 10, "type": "target-record", "source": "string", "external_ids": [ "string" ], "targets": [ { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "os": "string", "internal": false, "sensor": "string", "source_uri": "string" } ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z" } ], "asset_mappings": [ { "asset_type": "application", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "stability": "Managed", "schema_version": "1.3.30", "revision": 10, "observable": { "value": "1.2.3.4", "type": "ip" }, "asset_ref": "string", "type": "asset-mapping", "source": "string", "external_ids": [ "string" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "specificity": "Low", "confidence": "High" } ], "relationship_refs": [ "string" ], "tlp": "green", "incidents": [ { "description": "string", "assignees": [ "string" ], "detection_sources": [ "string" ], "meta": { "keyword": "string" }, "schema_version": "1.3.30", "revision": 10, "type": "incident", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "incident_time": { "opened": "2016-01-01T01:01:01Z", "discovered": "2016-01-01T01:01:01Z", "reported": "2016-01-01T01:01:01Z", "remediated": "2016-01-01T01:01:01Z", "closed": "2016-01-01T01:01:01Z", "rejected": "2016-01-01T01:01:01Z", "contained": "2016-01-01T01:01:01Z" }, "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "discovery_method": "Agent Disclosure", "source_uri": "string", "intended_effect": "Account Takeover", "categories": [ "Attrition" ], "status": "Closed", "language": "string", "detection_status": "active", "id": "string", "promotion_method": "Automated", "severity": "Critical", "tlp": "green", "scores": { "asset": 10.0 }, "techniques": [ "string" ], "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "short_id": "string", "tactics": [ "string" ] } ], "identity_assertion_refs": [ "string" ], "sightings": [ { "description": "string", "schema_version": "1.3.30", "revision": 10, "relations": [ { "origin": "string", "origin_uri": "string", "relation": "Allocated", "relation_info": { "keyword": "anything" }, "source": { "value": "1.2.3.4", "type": "ip" }, "related": { "value": "1.2.3.4", "type": "ip" } } ], "sensor_coordinates": { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "os": "string" }, "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "type": "sighting", "source": "string", "external_ids": [ "string" ], "targets": [ { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "os": "string" } ], "short_description": "string", "title": "string", "resolution": "detected", "internal": false, "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "detection_interval": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "source_uri": "string", "activity_interval": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "language": "string", "id": "string", "count": 10, "severity": "Critical", "tlp": "green", "modification_interval": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "context": { "http_events": [ { "process_guid": 10, "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "method": "CONNECT", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "HTTPEvent", "host": "string", "process_name": "string", "process_id": 10, "process_username": "string", "query": "string", "encrypted": true, "url_port": 10 } ], "process_create_events": [ { "parent_process_name": "string", "process_guid": 10, "parent_process_guid": 10, "process_disposition": "string", "parent_process_size": 10, "process_size": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_disposition": "string", "type": "ProcessCreateEvent", "parent_process_username": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "parent_creation_time": "2016-01-01T01:01:01Z", "process_args": "string" } ], "registry_delete_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryDeleteEvent", "registry_value": "string" } ], "file_modify_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileModifyEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "registry_set_events": [ { "process_guid": 10, "registry_data": "string", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "RegistrySetEvent", "registry_data_length": 10, "registry_value": "string", "registry_key": "string", "process_name": "string", "process_id": 10, "process_username": "string" } ], "file_create_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileCreateEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "registry_create_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryCreateEvent" } ], "library_load_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "type": "LibraryLoadEvent", "dll_library_name": "string", "dll_library_path": "string" } ], "file_move_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileMoveEvent", "old_name": "string", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "new_name": "string" } ], "file_delete_events": [ { "file_name": "string", "process_guid": 10, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "type": "FileDeleteEvent", "file_path": "string", "process_name": "string", "process_id": 10, "process_username": "string", "failed": false } ], "netflow_events": [ { "parent_process_name": "string", "byte_count_in": 10, "process_guid": 10, "process_path": "string", "traffic": { "destination_host_name": "string", "protocol": 10, "source_ip": "string", "destination_subnet": "string", "destination_ip": "string", "source_subnet": "string", "destination_port": 10, "direction": "incoming", "source_port": 10 }, "flow_time": "2016-01-01T01:01:01Z", "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "parent_process_account": "string", "type": "NetflowEvent", "process_account_type": "string", "parent_process_path": "string", "parent_process_id": 10, "parent_process_args": "string", "process_name": "string", "process_account": "string", "parent_process_account_type": "string", "process_hash": "string", "process_id": 10, "parent_process_hash": "string", "process_username": "string", "byte_count_out": 10, "process_args": "string" } ], "registry_rename_events": [ { "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "process_id": 10, "process_name": "string", "process_guid": 10, "process_username": "string", "registry_key": "string", "type": "RegistryRenameEvent", "registry_old_key": "string" } ] }, "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "sensor": "endpoint", "data": { "columns": [ { "name": "string", "type": "integer", "description": "string", "required": true, "short_description": "string" } ], "rows": [ [ "anything" ] ], "row_count": 10 } } ], "campaign_refs": [ "string" ], "vulnerability_refs": [ "string" ], "asset_properties_refs": [ "string" ], "relationships": [ { "description": "string", "schema_version": "1.3.30", "revision": 10, "target_ref": "string", "type": "relationship", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "source_ref": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "relationship_type": "attributed-to" } ], "timestamp": "2016-01-01T01:01:01Z", "verdict_refs": [ "string" ], "malware_refs": [ "string" ], "incident_refs": [ "string" ], "vulnerabilities": [ { "description": "string", "schema_version": "1.3.30", "revision": 10, "published_date": "2016-01-01T01:01:01Z", "cve": { "cve_data_meta": { "id": "string", "assigner": "string" } }, "configurations": { "CVE_data_version": "string", "nodes": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "children": [ { "operator": "AND", "cpe_match": [ { "vulnerable": true, "cpe23Uri": "string", "versionStartIncluding": "string", "versionEndIncluding": "string", "versionStartExcluding": "string", "versionEndExcluding": "string" } ], "negate": true } ], "negate": true } ] }, "type": "vulnerability", "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "tlp": "green", "timestamp": "2016-01-01T01:01:01Z", "last_modified_date": "2016-01-01T01:01:01Z", "impact": { "cvss_v2": { "integrity_impact": "complete", "target_distribution": "not_defined", "availability_requirement": "not_defined", "exploitability": "not_defined", "access_complexity": "low", "temporal_vector_string": "string", "exploitability_score": 10.0, "impact_score": 10.0, "user_interaction_required": true, "environmental_vector_string": "string", "obtain_other_privilege": true, "availability_impact": "complete", "access_vector": "network", "base_severity": "High", "confidentiality_impact": "complete", "confidentiality_requirement": "not_defined", "report_confidence": "not_defined", "authentication": "none", "base_score": 10.0, "obtain_user_privilege": true, "obtain_all_privilege": true, "collateral_damage_potential": "not_defined", "remediation_level": "not_defined", "vector_string": "string", "integrity_requirement": "not_defined" }, "cvss_v3": { "integrity_impact": "high", "modified_user_interaction": "none", "modified_scope": "not_defined", "availability_requirement": "high", "user_interaction": "none", "modified_integrity_impact": "not_defined", "privileges_required": "high", "exploitability_score": 10.0, "impact_score": 10.0, "environmental_severity": "critical", "modified_availability_impact": "not_defined", "availability_impact": "high", "scope": "changed", "exploit_code_maturity": "functional", "modified_attack_complexity": "not_defined", "base_severity": "critical", "confidentiality_impact": "high", "temporal_severity": "critical", "modified_confidentiality_impact": "not_defined", "confidentiality_requirement": "high", "report_confidence": "confirmed", "temporal_score": 10.0, "modified_privileges_required": "not_defined", "modified_attack_vector": "not_defined", "base_score": 10.0, "environmental_score": 10.0, "remediation_level": "high", "vector_string": "string", "integrity_requirement": "high", "attack_vector": "adjacent_network", "attack_complexity": "high" } } } ], "coas": [ { "description": "string", "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "stage": "Containment", "schema_version": "1.3.30", "revision": 10, "efficacy": "High", "type": "coa", "related_COAs": [ { "confidence": "High", "source": "string", "relationship": "string", "COA_id": "string" } ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "title": "string", "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "coa_type": "Diplomatic Actions", "language": "string", "id": "string", "tlp": "green", "objective": [ "string" ], "cost": "High", "timestamp": "2016-01-01T01:01:01Z", "open_c2_coa": { "type": "structured_coa", "id": "string", "action": { "type": "alert" }, "target": { "type": "acudid", "specifiers": "string" }, "actuator": { "type": "endpoint", "specifiers": [ "string" ] }, "modifiers": { "response": "acknowledge", "method": [ "acl" ], "additional_properties": { "context": "string" }, "time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "frequency": "string", "duration": "2016-01-01T01:01:01Z", "source": "string", "search": "cve", "option": "string", "id": "string", "location": "internal", "delay": "2016-01-01T01:01:01Z", "destination": "copy-to" } }, "structured_coa_type": "openc2", "impact": "string" } ] }, "description": "Describes a Bundle of any set of CTIM entities." }, "investigated_observables": { "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." } } }, "required": [ "bundle" ] } } ], "tags": [ "v2", "Investigation Save/Update" ], "summary": "Add Threat context to an investigation", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/investigation/{investigation-id}/observable/add": { "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "investigation_id": { "type": "string", "format": "uuid" } }, "required": [ "investigation_id" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "investigation-id", "description": "The investigation in scope", "type": "string", "required": true, "title": "InvestigationId", "format": "uuid", "default": "61399c06-5ea8-44ae-8256-cfcf4437ca5a" }, { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "observables": { "title": "ObservablesList", "description": "Observables that will be investigated", "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." } }, "modules": { "title": "Modules", "description": "Module Ids that will be called during investigation for iroh-enrich.", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." } }, "time_window": { "title": "TimeWindow", "description": "A window of start_time to end_time to filter returned sightings.", "type": "object", "properties": { "start_time": { "title": "StartTime", "description": "Return events after this time.", "type": "string", "format": "date-time", "example": "2026-08-18T22:03:32.803876481Z" }, "end_time": { "title": "EndTime", "description": "Will be used to filter Events that occurred before this time (defaults to now)", "type": "string", "format": "date-time", "example": "2026-08-18T22:03:32.803889681Z" } }, "required": [ "start_time" ] } }, "required": [ "observables" ] } } ], "tags": [ "v2", "Investigation Save/Update" ], "summary": "Add observables to an investigation", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/investigation/{investigation-id}/observable/remove": { "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "investigation_id": { "type": "string", "format": "uuid" } }, "required": [ "investigation_id" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "investigation-id", "description": "The investigation in scope", "type": "string", "required": true, "title": "InvestigationId", "format": "uuid", "default": "61399c06-5ea8-44ae-8256-cfcf4437ca5a" }, { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "observables": { "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." } } }, "required": [ "observables" ] } } ], "tags": [ "v2", "Investigation Save/Update" ], "summary": "Remove observables from an investigation.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/investigation/{investigation-id}/task": { "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": {}, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "investigation-id", "description": "The investigation in scope", "type": "string", "required": true, "title": "InvestigationId", "format": "uuid", "default": "61399c06-5ea8-44ae-8256-cfcf4437ca5a" }, { "in": "body", "name": "body", "description": "", "required": true, "schema": {} } ], "tags": [ "v2", "Investigation Save/Update" ], "summary": "Run a task", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/investigation/{investigation-id}/edit": { "put": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "investigation_id": { "type": "string", "format": "uuid" } }, "required": [ "investigation_id" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "title": { "type": "string", "minLength": 1, "maxLength": 1024 }, "description": { "type": "string", "minLength": 0, "maxLength": 5000 } }, "required": [ "title" ] } }, { "in": "path", "name": "investigation-id", "description": "The investigation in scope", "type": "string", "required": true, "title": "InvestigationId", "format": "uuid", "default": "61399c06-5ea8-44ae-8256-cfcf4437ca5a" } ], "tags": [ "v2", "Investigation Save/Update" ], "summary": "Saves an investigation in place.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/investigation/{investigation-id}/copy": { "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "investigation_id": { "type": "string", "format": "uuid" } }, "required": [ "investigation_id" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "saved": { "type": "boolean" }, "title": { "type": "string", "minLength": 1, "maxLength": 1024 }, "description": { "type": "string", "minLength": 0, "maxLength": 5000 } } } }, { "in": "path", "name": "investigation-id", "description": "The investigation in scope", "type": "string", "required": true, "title": "InvestigationId", "format": "uuid", "default": "61399c06-5ea8-44ae-8256-cfcf4437ca5a" } ], "tags": [ "v2", "Investigation Save/Update" ], "summary": "Create a copy of an investigation.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/investigation/{investigation-id}/delete": { "delete": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "success": { "type": "boolean" } }, "required": [ "success" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "investigation-id", "description": "The investigation in scope", "type": "string", "required": true, "title": "InvestigationId", "format": "uuid", "default": "61399c06-5ea8-44ae-8256-cfcf4437ca5a" } ], "tags": [ "v2", "Investigation Save/Update" ], "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/investigation/{investigation-id}/save-as": { "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "investigation_id": { "type": "string", "format": "uuid" } }, "required": [ "investigation_id" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "title": { "type": "string", "minLength": 1, "maxLength": 1024 }, "description": { "type": "string", "minLength": 0, "maxLength": 5000 } }, "required": [ "title" ] } }, { "in": "path", "name": "investigation-id", "description": "The investigation in scope", "type": "string", "required": true, "title": "InvestigationId", "format": "uuid", "default": "61399c06-5ea8-44ae-8256-cfcf4437ca5a" } ], "tags": [ "v2", "Investigation Save/Update" ], "summary": "Saves an investigation as a new entity.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident": { "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "201": { "schema": { "type": "object", "properties": { "assignees": { "type": "array", "items": { "type": "string" } }, "categories": { "type": "array", "items": { "type": "string", "enum": [ "Attrition", "Denial of Service", "Exercise", "Exercise/Network Defense Testing", "Explained Anomaly", "Forensics", "Improper Usage", "Intelligence", "Investigating", "Investigation", "Malicious Code", "Malicious Logic", "Non-Compliant", "Reconnaissance", "Root Level", "Scans/Probes/Attempted Access", "Unauthorized Access", "Unsuccessful", "User Level", "eDiscovery" ] } }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "detection_sources": { "type": "array", "items": { "type": "string" } }, "detection_status": { "title": "DetectionStatusType", "type": "string", "enum": [ "active", "inactive_merged", "inactive_expired", "inactive_oversized", "inactive_user_closed" ], "description": "Whether the incident is actively receiving detection data updates" }, "discovery_method": { "type": "string", "enum": [ "SecureX Threat Hunting", "Agent Disclosure", "Antivirus", "Audit", "Customer", "External - Fraud Detection", "Financial Audit", "HIPS", "IT Audit", "Incident Response", "Internal - Fraud Detection", "Law Enforcement", "Log Review", "Monitoring Service", "NIDS", "Security Alarm", "Unknown", "Unrelated Party", "User" ] }, "incident_time": { "type": "object", "properties": { "opened": { "type": "string" }, "closed": { "type": "string" }, "discovered": { "type": "string" }, "rejected": { "type": "string" }, "remediated": { "type": "string" }, "reported": { "type": "string" } }, "required": [ "opened" ] }, "intended_effect": { "type": "string", "enum": [ "Account Takeover", "Advantage", "Advantage - Economic", "Advantage - Military", "Advantage - Political", "Brand Damage", "Competitive Advantage", "Degradation of Service", "Denial and Deception", "Destruction", "Disruption", "Embarrassment", "Exposure", "Extortion", "Fraud", "Harassment", "ICS Control", "Theft", "Theft - Credential Theft", "Theft - Identity Theft", "Theft - Intellectual Property", "Theft - Theft of Proprietary Information", "Traffic Diversion", "Unauthorized Access" ] }, "meta": { "type": "object", "properties": { "ai_description": { "type": "boolean" }, "helios_report_generated": { "type": "boolean" } } }, "promotion_method": { "type": "string", "enum": [ "Automated", "Manual" ] }, "scores": { "type": "object", "properties": { "asset": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 10 }, "global": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 1000 }, "ml_score": { "type": "number", "format": "double" }, "ttp": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 100 } } }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_id": { "type": "string" }, "status": { "title": "IncidentStatusType", "type": "string", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ], "description": "The status of the incident" }, "tactics": { "type": "array", "items": { "type": "string" } }, "techniques": { "type": "array", "items": { "type": "string" } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "incident" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "confidence", "incident_time", "status", "id", "groups", "schema_version", "type" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "assignees": { "type": "array", "items": { "type": "string" } }, "categories": { "type": "array", "items": { "type": "string", "enum": [ "Attrition", "Denial of Service", "Exercise", "Exercise/Network Defense Testing", "Explained Anomaly", "Forensics", "Improper Usage", "Intelligence", "Investigating", "Investigation", "Malicious Code", "Malicious Logic", "Non-Compliant", "Reconnaissance", "Root Level", "Scans/Probes/Attempted Access", "Unauthorized Access", "Unsuccessful", "User Level", "eDiscovery" ] } }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "detection_sources": { "type": "array", "items": { "type": "string" } }, "detection_status": { "title": "DetectionStatusType", "type": "string", "enum": [ "active", "inactive_merged", "inactive_expired", "inactive_oversized", "inactive_user_closed" ], "description": "Whether the incident is actively receiving detection data updates" }, "discovery_method": { "type": "string", "enum": [ "SecureX Threat Hunting", "Agent Disclosure", "Antivirus", "Audit", "Customer", "External - Fraud Detection", "Financial Audit", "HIPS", "IT Audit", "Incident Response", "Internal - Fraud Detection", "Law Enforcement", "Log Review", "Monitoring Service", "NIDS", "Security Alarm", "Unknown", "Unrelated Party", "User" ] }, "incident_time": { "type": "object", "properties": { "opened": { "type": "string" }, "closed": { "type": "string" }, "discovered": { "type": "string" }, "rejected": { "type": "string" }, "remediated": { "type": "string" }, "reported": { "type": "string" } }, "required": [ "opened" ] }, "intended_effect": { "type": "string", "enum": [ "Account Takeover", "Advantage", "Advantage - Economic", "Advantage - Military", "Advantage - Political", "Brand Damage", "Competitive Advantage", "Degradation of Service", "Denial and Deception", "Destruction", "Disruption", "Embarrassment", "Exposure", "Extortion", "Fraud", "Harassment", "ICS Control", "Theft", "Theft - Credential Theft", "Theft - Identity Theft", "Theft - Intellectual Property", "Theft - Theft of Proprietary Information", "Traffic Diversion", "Unauthorized Access" ] }, "meta": { "type": "object", "properties": { "ai_description": { "type": "boolean" }, "helios_report_generated": { "type": "boolean" } } }, "promotion_method": { "type": "string", "enum": [ "Automated", "Manual" ] }, "scores": { "type": "object", "properties": { "asset": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 10 }, "global": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 1000 }, "ml_score": { "type": "number", "format": "double" }, "ttp": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 100 } } }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_id": { "type": "string" }, "status": { "title": "IncidentStatusType", "type": "string", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ], "description": "The status of the incident" }, "tactics": { "type": "array", "items": { "type": "string" } }, "techniques": { "type": "array", "items": { "type": "string" } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] } }, "required": [ "confidence", "incident_time", "status" ] } } ], "tags": [ "v2", "Incident" ], "summary": "Create New Incident", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/delete": { "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "success?": { "type": "boolean" } }, "required": [ "success?" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "incident_ids": { "type": "array", "items": { "type": "string" } } }, "required": [ "incident_ids" ] } } ], "tags": [ "v2", "Incident" ], "summary": "Delete Bulk Incidents", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/search": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": { "assignees": { "type": "array", "items": { "type": "string" } }, "categories": { "type": "array", "items": { "type": "string", "enum": [ "Attrition", "Denial of Service", "Exercise", "Exercise/Network Defense Testing", "Explained Anomaly", "Forensics", "Improper Usage", "Intelligence", "Investigating", "Investigation", "Malicious Code", "Malicious Logic", "Non-Compliant", "Reconnaissance", "Root Level", "Scans/Probes/Attempted Access", "Unauthorized Access", "Unsuccessful", "User Level", "eDiscovery" ] } }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "detection_sources": { "type": "array", "items": { "type": "string" } }, "detection_status": { "title": "DetectionStatusType", "type": "string", "enum": [ "active", "inactive_merged", "inactive_expired", "inactive_oversized", "inactive_user_closed" ], "description": "Whether the incident is actively receiving detection data updates" }, "discovery_method": { "type": "string", "enum": [ "SecureX Threat Hunting", "Agent Disclosure", "Antivirus", "Audit", "Customer", "External - Fraud Detection", "Financial Audit", "HIPS", "IT Audit", "Incident Response", "Internal - Fraud Detection", "Law Enforcement", "Log Review", "Monitoring Service", "NIDS", "Security Alarm", "Unknown", "Unrelated Party", "User" ] }, "incident_time": { "type": "object", "properties": { "opened": { "type": "string" }, "closed": { "type": "string" }, "discovered": { "type": "string" }, "rejected": { "type": "string" }, "remediated": { "type": "string" }, "reported": { "type": "string" } }, "required": [ "opened" ] }, "intended_effect": { "type": "string", "enum": [ "Account Takeover", "Advantage", "Advantage - Economic", "Advantage - Military", "Advantage - Political", "Brand Damage", "Competitive Advantage", "Degradation of Service", "Denial and Deception", "Destruction", "Disruption", "Embarrassment", "Exposure", "Extortion", "Fraud", "Harassment", "ICS Control", "Theft", "Theft - Credential Theft", "Theft - Identity Theft", "Theft - Intellectual Property", "Theft - Theft of Proprietary Information", "Traffic Diversion", "Unauthorized Access" ] }, "meta": { "type": "object", "properties": { "ai_description": { "type": "boolean" }, "helios_report_generated": { "type": "boolean" } } }, "promotion_method": { "type": "string", "enum": [ "Automated", "Manual" ] }, "scores": { "type": "object", "properties": { "asset": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 10 }, "global": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 1000 }, "ml_score": { "type": "number", "format": "double" }, "ttp": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 100 } } }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_id": { "type": "string" }, "status": { "title": "IncidentStatusType", "type": "string", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ], "description": "The status of the incident" }, "tactics": { "type": "array", "items": { "type": "string" } }, "techniques": { "type": "array", "items": { "type": "string" } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "incident" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "confidence", "incident_time", "status", "id", "groups", "schema_version", "type" ] } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "query", "name": "sort_by", "description": "Sort result on fields.\n\nThe following fields are supported:\nid, language, revision, schema_version, source, source_uri, timestamp, title, tlp\n\nFields can be combined with ',' and sort order can be\nspecified by ':asc' and ':desc'. For example:\n- id # sort by id ascending\n- id:desc # sort by id descending\n- id,language:desc # sort by id ascending, then language descending", "type": "string", "required": false }, { "in": "query", "name": "sort_order", "description": "", "type": "string", "required": false, "enum": [ "asc", "desc" ] }, { "description": "A integer greater than 0.", "format": "int64", "name": "offset", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "description": "A integer greater than 0.", "format": "int64", "name": "limit", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "in": "query", "name": "search_after", "description": "", "type": "array", "required": false, "items": { "type": "string" }, "x-anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "string" } ], "allowEmptyValue": true }, { "in": "query", "name": "fields", "description": "", "type": "array", "required": false, "items": { "type": "array", "items": { "type": "string", "enum": [ "assignees", "confidence", "detection_sources", "discovery_method", "id", "incident_time.opened", "incident_time.discovered", "incident_time.reported", "incident_time.remediated", "incident_time.closed", "incident_time.rejected", "intended_effect", "language", "meta", "promotion_method", "revision", "schema_version", "source", "source_uri", "status", "timestamp", "title", "tlp" ] } }, "x-anyOf": [ { "type": "array", "items": { "type": "array", "items": { "type": "string", "enum": [ "assignees", "confidence", "detection_sources", "discovery_method", "id", "incident_time.opened", "incident_time.discovered", "incident_time.reported", "incident_time.remediated", "incident_time.closed", "incident_time.rejected", "intended_effect", "language", "meta", "promotion_method", "revision", "schema_version", "source", "source_uri", "status", "timestamp", "title", "tlp" ] } } }, { "type": "string" } ], "allowEmptyValue": true }, { "in": "query", "name": "tlp", "description": "", "type": "string", "required": false, "enum": [ "amber", "green", "red", "white" ] }, { "in": "query", "name": "from", "description": "", "type": "string", "required": false, "format": "date-time" }, { "in": "query", "name": "to", "description": "", "type": "string", "required": false, "format": "date-time" }, { "in": "query", "name": "language", "description": "", "type": "string", "required": false }, { "in": "query", "name": "id", "description": "", "type": "string", "required": false }, { "in": "query", "name": "search_fields", "description": "", "type": "array", "required": false, "items": { "type": "string", "enum": [ "id", "short_description", "title", "source", "description" ] }, "x-anyOf": [ { "type": "array", "items": { "type": "string", "enum": [ "id", "short_description", "title", "source", "description" ] } }, { "type": "string" } ], "allowEmptyValue": true }, { "in": "query", "name": "source", "description": "", "type": "string", "required": false }, { "in": "query", "name": "query", "description": "", "type": "string", "required": false }, { "in": "query", "name": "simple_query", "description": "Query String with simple query format", "type": "string", "required": false }, { "description": "A integer greater than 0.", "format": "int64", "name": "revision", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "in": "query", "name": "assignees", "description": "", "type": "string", "required": false }, { "in": "query", "name": "categories", "description": "", "type": "string", "required": false }, { "in": "query", "name": "confidence", "description": "", "type": "string", "required": false }, { "in": "query", "name": "detection_sources", "description": "", "type": "string", "required": false }, { "in": "query", "name": "discovery_method", "description": "", "type": "string", "required": false }, { "in": "query", "name": "high_impact", "description": "", "type": "boolean", "required": false }, { "in": "query", "name": "intended_effect", "description": "", "type": "string", "required": false }, { "in": "query", "name": "promotion_method", "description": "", "type": "string", "required": false }, { "in": "query", "name": "status", "description": "The status of the incident", "type": "string", "required": false, "title": "IncidentStatusType", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ] } ], "tags": [ "v2", "Incident" ], "summary": "Search incidents", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/search/count": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "query", "name": "sort_by", "description": "Sort result on fields.\n\nThe following fields are supported:\nid, language, revision, schema_version, source, source_uri, timestamp, title, tlp\n\nFields can be combined with ',' and sort order can be\nspecified by ':asc' and ':desc'. For example:\n- id # sort by id ascending\n- id:desc # sort by id descending\n- id,language:desc # sort by id ascending, then language descending", "type": "string", "required": false }, { "in": "query", "name": "sort_order", "description": "", "type": "string", "required": false, "enum": [ "asc", "desc" ] }, { "description": "A integer greater than 0.", "format": "int64", "name": "offset", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "description": "A integer greater than 0.", "format": "int64", "name": "limit", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "in": "query", "name": "search_after", "description": "", "type": "array", "required": false, "items": { "type": "string" }, "x-anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "string" } ], "allowEmptyValue": true }, { "in": "query", "name": "fields", "description": "", "type": "array", "required": false, "items": { "type": "array", "items": { "type": "string", "enum": [ "assignees", "confidence", "detection_sources", "discovery_method", "id", "incident_time.opened", "incident_time.discovered", "incident_time.reported", "incident_time.remediated", "incident_time.closed", "incident_time.rejected", "intended_effect", "language", "meta", "promotion_method", "revision", "schema_version", "source", "source_uri", "status", "timestamp", "title", "tlp" ] } }, "x-anyOf": [ { "type": "array", "items": { "type": "array", "items": { "type": "string", "enum": [ "assignees", "confidence", "detection_sources", "discovery_method", "id", "incident_time.opened", "incident_time.discovered", "incident_time.reported", "incident_time.remediated", "incident_time.closed", "incident_time.rejected", "intended_effect", "language", "meta", "promotion_method", "revision", "schema_version", "source", "source_uri", "status", "timestamp", "title", "tlp" ] } } }, { "type": "string" } ], "allowEmptyValue": true }, { "in": "query", "name": "tlp", "description": "", "type": "string", "required": false, "enum": [ "amber", "green", "red", "white" ] }, { "in": "query", "name": "from", "description": "", "type": "string", "required": false, "format": "date-time" }, { "in": "query", "name": "to", "description": "", "type": "string", "required": false, "format": "date-time" }, { "in": "query", "name": "language", "description": "", "type": "string", "required": false }, { "in": "query", "name": "id", "description": "", "type": "string", "required": false }, { "in": "query", "name": "search_fields", "description": "", "type": "array", "required": false, "items": { "type": "string", "enum": [ "id", "short_description", "title", "source", "description" ] }, "x-anyOf": [ { "type": "array", "items": { "type": "string", "enum": [ "id", "short_description", "title", "source", "description" ] } }, { "type": "string" } ], "allowEmptyValue": true }, { "in": "query", "name": "source", "description": "", "type": "string", "required": false }, { "in": "query", "name": "query", "description": "", "type": "string", "required": false }, { "in": "query", "name": "simple_query", "description": "Query String with simple query format", "type": "string", "required": false }, { "description": "A integer greater than 0.", "format": "int64", "name": "revision", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "in": "query", "name": "assignees", "description": "", "type": "string", "required": false }, { "in": "query", "name": "categories", "description": "", "type": "string", "required": false }, { "in": "query", "name": "confidence", "description": "", "type": "string", "required": false }, { "in": "query", "name": "detection_sources", "description": "", "type": "string", "required": false }, { "in": "query", "name": "discovery_method", "description": "", "type": "string", "required": false }, { "in": "query", "name": "high_impact", "description": "", "type": "boolean", "required": false }, { "in": "query", "name": "intended_effect", "description": "", "type": "string", "required": false }, { "in": "query", "name": "promotion_method", "description": "", "type": "string", "required": false }, { "in": "query", "name": "status", "description": "The status of the incident", "type": "string", "required": false, "title": "IncidentStatusType", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ] } ], "tags": [ "v2", "Incident" ], "summary": "Get Count of Incidents by Search", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/{incident-id}": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "assignees": { "type": "array", "items": { "type": "string" } }, "categories": { "type": "array", "items": { "type": "string", "enum": [ "Attrition", "Denial of Service", "Exercise", "Exercise/Network Defense Testing", "Explained Anomaly", "Forensics", "Improper Usage", "Intelligence", "Investigating", "Investigation", "Malicious Code", "Malicious Logic", "Non-Compliant", "Reconnaissance", "Root Level", "Scans/Probes/Attempted Access", "Unauthorized Access", "Unsuccessful", "User Level", "eDiscovery" ] } }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "detection_sources": { "type": "array", "items": { "type": "string" } }, "detection_status": { "title": "DetectionStatusType", "type": "string", "enum": [ "active", "inactive_merged", "inactive_expired", "inactive_oversized", "inactive_user_closed" ], "description": "Whether the incident is actively receiving detection data updates" }, "discovery_method": { "type": "string", "enum": [ "SecureX Threat Hunting", "Agent Disclosure", "Antivirus", "Audit", "Customer", "External - Fraud Detection", "Financial Audit", "HIPS", "IT Audit", "Incident Response", "Internal - Fraud Detection", "Law Enforcement", "Log Review", "Monitoring Service", "NIDS", "Security Alarm", "Unknown", "Unrelated Party", "User" ] }, "incident_time": { "type": "object", "properties": { "opened": { "type": "string" }, "closed": { "type": "string" }, "discovered": { "type": "string" }, "rejected": { "type": "string" }, "remediated": { "type": "string" }, "reported": { "type": "string" } }, "required": [ "opened" ] }, "intended_effect": { "type": "string", "enum": [ "Account Takeover", "Advantage", "Advantage - Economic", "Advantage - Military", "Advantage - Political", "Brand Damage", "Competitive Advantage", "Degradation of Service", "Denial and Deception", "Destruction", "Disruption", "Embarrassment", "Exposure", "Extortion", "Fraud", "Harassment", "ICS Control", "Theft", "Theft - Credential Theft", "Theft - Identity Theft", "Theft - Intellectual Property", "Theft - Theft of Proprietary Information", "Traffic Diversion", "Unauthorized Access" ] }, "meta": { "type": "object", "properties": { "ai_description": { "type": "boolean" }, "helios_report_generated": { "type": "boolean" } } }, "promotion_method": { "type": "string", "enum": [ "Automated", "Manual" ] }, "scores": { "type": "object", "properties": { "asset": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 10 }, "global": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 1000 }, "ml_score": { "type": "number", "format": "double" }, "ttp": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 100 } } }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_id": { "type": "string" }, "status": { "title": "IncidentStatusType", "type": "string", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ], "description": "The status of the incident" }, "tactics": { "type": "array", "items": { "type": "string" } }, "techniques": { "type": "array", "items": { "type": "string" } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "incident" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "confidence", "incident_time", "status", "id", "groups", "schema_version", "type" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v2", "Incident" ], "summary": "Get one incident.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] }, "put": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "assignees": { "type": "array", "items": { "type": "string" } }, "categories": { "type": "array", "items": { "type": "string", "enum": [ "Attrition", "Denial of Service", "Exercise", "Exercise/Network Defense Testing", "Explained Anomaly", "Forensics", "Improper Usage", "Intelligence", "Investigating", "Investigation", "Malicious Code", "Malicious Logic", "Non-Compliant", "Reconnaissance", "Root Level", "Scans/Probes/Attempted Access", "Unauthorized Access", "Unsuccessful", "User Level", "eDiscovery" ] } }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "detection_sources": { "type": "array", "items": { "type": "string" } }, "detection_status": { "title": "DetectionStatusType", "type": "string", "enum": [ "active", "inactive_merged", "inactive_expired", "inactive_oversized", "inactive_user_closed" ], "description": "Whether the incident is actively receiving detection data updates" }, "discovery_method": { "type": "string", "enum": [ "SecureX Threat Hunting", "Agent Disclosure", "Antivirus", "Audit", "Customer", "External - Fraud Detection", "Financial Audit", "HIPS", "IT Audit", "Incident Response", "Internal - Fraud Detection", "Law Enforcement", "Log Review", "Monitoring Service", "NIDS", "Security Alarm", "Unknown", "Unrelated Party", "User" ] }, "incident_time": { "type": "object", "properties": { "opened": { "type": "string" }, "closed": { "type": "string" }, "discovered": { "type": "string" }, "rejected": { "type": "string" }, "remediated": { "type": "string" }, "reported": { "type": "string" } }, "required": [ "opened" ] }, "intended_effect": { "type": "string", "enum": [ "Account Takeover", "Advantage", "Advantage - Economic", "Advantage - Military", "Advantage - Political", "Brand Damage", "Competitive Advantage", "Degradation of Service", "Denial and Deception", "Destruction", "Disruption", "Embarrassment", "Exposure", "Extortion", "Fraud", "Harassment", "ICS Control", "Theft", "Theft - Credential Theft", "Theft - Identity Theft", "Theft - Intellectual Property", "Theft - Theft of Proprietary Information", "Traffic Diversion", "Unauthorized Access" ] }, "meta": { "type": "object", "properties": { "ai_description": { "type": "boolean" }, "helios_report_generated": { "type": "boolean" } } }, "promotion_method": { "type": "string", "enum": [ "Automated", "Manual" ] }, "scores": { "type": "object", "properties": { "asset": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 10 }, "global": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 1000 }, "ml_score": { "type": "number", "format": "double" }, "ttp": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 100 } } }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_id": { "type": "string" }, "status": { "title": "IncidentStatusType", "type": "string", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ], "description": "The status of the incident" }, "tactics": { "type": "array", "items": { "type": "string" } }, "techniques": { "type": "array", "items": { "type": "string" } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "incident" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "confidence", "incident_time", "status", "id", "groups", "schema_version", "type" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" }, { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "assignees": { "type": "array", "items": { "type": "string" } }, "categories": { "type": "array", "items": { "type": "string", "enum": [ "Attrition", "Denial of Service", "Exercise", "Exercise/Network Defense Testing", "Explained Anomaly", "Forensics", "Improper Usage", "Intelligence", "Investigating", "Investigation", "Malicious Code", "Malicious Logic", "Non-Compliant", "Reconnaissance", "Root Level", "Scans/Probes/Attempted Access", "Unauthorized Access", "Unsuccessful", "User Level", "eDiscovery" ] } }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "detection_sources": { "type": "array", "items": { "type": "string" } }, "detection_status": { "title": "DetectionStatusType", "type": "string", "enum": [ "active", "inactive_merged", "inactive_expired", "inactive_oversized", "inactive_user_closed" ], "description": "Whether the incident is actively receiving detection data updates" }, "discovery_method": { "type": "string", "enum": [ "SecureX Threat Hunting", "Agent Disclosure", "Antivirus", "Audit", "Customer", "External - Fraud Detection", "Financial Audit", "HIPS", "IT Audit", "Incident Response", "Internal - Fraud Detection", "Law Enforcement", "Log Review", "Monitoring Service", "NIDS", "Security Alarm", "Unknown", "Unrelated Party", "User" ] }, "incident_time": { "type": "object", "properties": { "opened": { "type": "string" }, "closed": { "type": "string" }, "discovered": { "type": "string" }, "rejected": { "type": "string" }, "remediated": { "type": "string" }, "reported": { "type": "string" } }, "required": [ "opened" ] }, "intended_effect": { "type": "string", "enum": [ "Account Takeover", "Advantage", "Advantage - Economic", "Advantage - Military", "Advantage - Political", "Brand Damage", "Competitive Advantage", "Degradation of Service", "Denial and Deception", "Destruction", "Disruption", "Embarrassment", "Exposure", "Extortion", "Fraud", "Harassment", "ICS Control", "Theft", "Theft - Credential Theft", "Theft - Identity Theft", "Theft - Intellectual Property", "Theft - Theft of Proprietary Information", "Traffic Diversion", "Unauthorized Access" ] }, "meta": { "type": "object", "properties": { "ai_description": { "type": "boolean" }, "helios_report_generated": { "type": "boolean" } } }, "promotion_method": { "type": "string", "enum": [ "Automated", "Manual" ] }, "scores": { "type": "object", "properties": { "asset": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 10 }, "global": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 1000 }, "ml_score": { "type": "number", "format": "double" }, "ttp": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 100 } } }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_id": { "type": "string" }, "status": { "title": "IncidentStatusType", "type": "string", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ], "description": "The status of the incident" }, "tactics": { "type": "array", "items": { "type": "string" } }, "techniques": { "type": "array", "items": { "type": "string" } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] } }, "required": [ "confidence", "incident_time", "status" ] } } ], "tags": [ "v2", "Incident" ], "summary": "Update one incident.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] }, "delete": { "responses": { "204": { "schema": {}, "description": "" }, "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v2", "Incident" ], "summary": "Delete one incident.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] }, "patch": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "assignees": { "type": "array", "items": { "type": "string" } }, "categories": { "type": "array", "items": { "type": "string", "enum": [ "Attrition", "Denial of Service", "Exercise", "Exercise/Network Defense Testing", "Explained Anomaly", "Forensics", "Improper Usage", "Intelligence", "Investigating", "Investigation", "Malicious Code", "Malicious Logic", "Non-Compliant", "Reconnaissance", "Root Level", "Scans/Probes/Attempted Access", "Unauthorized Access", "Unsuccessful", "User Level", "eDiscovery" ] } }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "detection_sources": { "type": "array", "items": { "type": "string" } }, "detection_status": { "title": "DetectionStatusType", "type": "string", "enum": [ "active", "inactive_merged", "inactive_expired", "inactive_oversized", "inactive_user_closed" ], "description": "Whether the incident is actively receiving detection data updates" }, "discovery_method": { "type": "string", "enum": [ "SecureX Threat Hunting", "Agent Disclosure", "Antivirus", "Audit", "Customer", "External - Fraud Detection", "Financial Audit", "HIPS", "IT Audit", "Incident Response", "Internal - Fraud Detection", "Law Enforcement", "Log Review", "Monitoring Service", "NIDS", "Security Alarm", "Unknown", "Unrelated Party", "User" ] }, "incident_time": { "type": "object", "properties": { "opened": { "type": "string" }, "closed": { "type": "string" }, "discovered": { "type": "string" }, "rejected": { "type": "string" }, "remediated": { "type": "string" }, "reported": { "type": "string" } }, "required": [ "opened" ] }, "intended_effect": { "type": "string", "enum": [ "Account Takeover", "Advantage", "Advantage - Economic", "Advantage - Military", "Advantage - Political", "Brand Damage", "Competitive Advantage", "Degradation of Service", "Denial and Deception", "Destruction", "Disruption", "Embarrassment", "Exposure", "Extortion", "Fraud", "Harassment", "ICS Control", "Theft", "Theft - Credential Theft", "Theft - Identity Theft", "Theft - Intellectual Property", "Theft - Theft of Proprietary Information", "Traffic Diversion", "Unauthorized Access" ] }, "meta": { "type": "object", "properties": { "ai_description": { "type": "boolean" }, "helios_report_generated": { "type": "boolean" } } }, "promotion_method": { "type": "string", "enum": [ "Automated", "Manual" ] }, "scores": { "type": "object", "properties": { "asset": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 10 }, "global": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 1000 }, "ml_score": { "type": "number", "format": "double" }, "ttp": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 100 } } }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_id": { "type": "string" }, "status": { "title": "IncidentStatusType", "type": "string", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ], "description": "The status of the incident" }, "tactics": { "type": "array", "items": { "type": "string" } }, "techniques": { "type": "array", "items": { "type": "string" } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "incident" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "confidence", "incident_time", "status", "id", "groups", "schema_version", "type" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" }, { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "assignees": { "type": "array", "items": { "type": "string" } }, "categories": { "type": "array", "items": { "type": "string", "enum": [ "Attrition", "Denial of Service", "Exercise", "Exercise/Network Defense Testing", "Explained Anomaly", "Forensics", "Improper Usage", "Intelligence", "Investigating", "Investigation", "Malicious Code", "Malicious Logic", "Non-Compliant", "Reconnaissance", "Root Level", "Scans/Probes/Attempted Access", "Unauthorized Access", "Unsuccessful", "User Level", "eDiscovery" ] } }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "detection_sources": { "type": "array", "items": { "type": "string" } }, "detection_status": { "title": "DetectionStatusType", "type": "string", "enum": [ "active", "inactive_merged", "inactive_expired", "inactive_oversized", "inactive_user_closed" ], "description": "Whether the incident is actively receiving detection data updates" }, "discovery_method": { "type": "string", "enum": [ "SecureX Threat Hunting", "Agent Disclosure", "Antivirus", "Audit", "Customer", "External - Fraud Detection", "Financial Audit", "HIPS", "IT Audit", "Incident Response", "Internal - Fraud Detection", "Law Enforcement", "Log Review", "Monitoring Service", "NIDS", "Security Alarm", "Unknown", "Unrelated Party", "User" ] }, "incident_time": { "type": "object", "properties": { "opened": { "type": "string" }, "closed": { "type": "string" }, "discovered": { "type": "string" }, "rejected": { "type": "string" }, "remediated": { "type": "string" }, "reported": { "type": "string" } }, "required": [ "opened" ] }, "intended_effect": { "type": "string", "enum": [ "Account Takeover", "Advantage", "Advantage - Economic", "Advantage - Military", "Advantage - Political", "Brand Damage", "Competitive Advantage", "Degradation of Service", "Denial and Deception", "Destruction", "Disruption", "Embarrassment", "Exposure", "Extortion", "Fraud", "Harassment", "ICS Control", "Theft", "Theft - Credential Theft", "Theft - Identity Theft", "Theft - Intellectual Property", "Theft - Theft of Proprietary Information", "Traffic Diversion", "Unauthorized Access" ] }, "meta": { "type": "object", "properties": { "ai_description": { "type": "boolean" }, "helios_report_generated": { "type": "boolean" } } }, "promotion_method": { "type": "string", "enum": [ "Automated", "Manual" ] }, "scores": { "type": "object", "properties": { "asset": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 10 }, "global": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 1000 }, "ml_score": { "type": "number", "format": "double" }, "ttp": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 100 } } }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "status": { "title": "IncidentStatusType", "type": "string", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ], "description": "The status of the incident" }, "tactics": { "type": "array", "items": { "type": "string" } }, "techniques": { "type": "array", "items": { "type": "string" } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] } } } } ], "tags": [ "v2", "Incident" ], "summary": "Patch one incident.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/{incident-id}/actions-taken": { "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "201": { "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" }, { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.572913470Z" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573033076Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "action", "completed_at", "description", "reason", "source", "source_url", "started_at", "status", "observable" ], "description": "An action reported by a data source or XDR Automation." } } } ], "tags": [ "v2", "Incident" ], "summary": "Post actions taken for an incident", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/{incident-id}/link/{entity-type}/{entity-id}": { "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "201": { "schema": { "type": "object", "properties": { "relationship_type": { "type": "string" }, "authorized_groups": { "type": "array", "items": { "type": "string" } }, "source_ref": { "type": "string" }, "target_ref": { "type": "string" }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "relationship" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "relationship_type", "source_ref", "target_ref", "id", "groups", "schema_version", "type" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident to get data for", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" }, { "in": "path", "name": "entity-type", "description": "The type of entity to attach to an incident", "type": "string", "required": true, "enum": [ "casebook", "incident", "investigation" ] }, { "in": "path", "name": "entity-id", "description": "The ID of the entity to be attached", "type": "string", "required": true, "minLength": 10, "maxLength": 1000 } ], "tags": [ "v2", "Incident" ], "summary": "Link incident and entity (investigation | casebook | incident)", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] }, "delete": { "responses": { "204": { "schema": {}, "description": "" }, "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident to get data for", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" }, { "in": "path", "name": "entity-type", "description": "The type of entity to attach to an incident", "type": "string", "required": true, "enum": [ "casebook", "incident", "investigation" ] }, { "in": "path", "name": "entity-id", "description": "The ID of the entity to be attached", "type": "string", "required": true, "minLength": 10, "maxLength": 1000 } ], "tags": [ "v2", "Incident" ], "summary": "Unlink incident and entity. (investigation | casebook | incident)", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/{incident-id}/update-context": { "post": { "responses": { "204": { "schema": {}, "description": "" }, "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" }, { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "refresh": { "default": false, "type": "boolean", "description": "Refresh all relevant incident information." }, "observables": { "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." }, "description": "Relevant reputations will be fetched, and User Resolution will be attempted for any email and user passed in." }, "targets": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "endpoint", "description": "The sensor/actuator name that best fits a device." }, "observables": { "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string", "example": "string", "description": "The value of the observable." }, "type": { "type": "string", "enum": [ "acudid", "amp_computer_guid", "certificate_common_name", "certificate_issuer", "certificate_serial", "cisco_cm_id", "cisco_mid", "cisco_uc_id", "cortex_agent_id", "crowdstrike_id", "cvm_id", "cybereason_id", "darktrace_id", "device", "domain", "email", "email_messageid", "email_subject", "file_name", "file_path", "google_chromebook_id", "google_cloud_id", "hostname", "imei", "imsi", "intune_id", "ip", "ipv6", "jamf_management_id", "mac_address", "md5", "meraki_network_id", "meraki_node_sn", "meraki_org_id", "ms_machine_id", "mutex", "ngfw_id", "ngfw_name", "odns_identity", "odns_identity_label", "orbital_node_id", "pki_serial", "process_args", "process_hash", "process_name", "process_path", "process_uid", "process_username", "processor_id", "registry_key", "registry_name", "registry_path", "s1_agent_id", "secure_access_id", "serial_number", "service_now_id", "sha1", "sha256", "swc_device_id", "trend_micro_id", "url", "user", "user_agent" ], "example": "acudid", "description": "The type of observable." } }, "required": [ "value", "type" ], "example": { "value": "1.2.3.4", "type": "ip" }, "description": "A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable." }, "example": [ { "value": "1.2.3.4", "type": "ip" } ] }, "observed_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "Time of the observation. If the observation was made over a period of time, than this field indicates the start of that period." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If the observation was made over a period of time, than this field indicates the end of that period." } }, "required": [ "start_time" ], "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "Period of time when a cyber observation is valid. `start_time` must come before `end_time` (if specified)." }, "os": { "type": "string", "example": "string" } }, "required": [ "type", "observables", "observed_time" ], "example": { "type": "endpoint", "observables": [ { "value": "1.2.3.4", "type": "ip" } ], "observed_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "os": "string" }, "description": "Describes the target of the sighting and contains identifying observables for the target." }, "description": "Asset resolution will be attempted for every target in the list with a resolvable observable in it's observable list." }, "detection_sources": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "description": "The sources for detections in an incident", "example": [ "Cisco XDR Analytics", "Microsoft Defender for Endpoint" ] }, "tactics": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "description": "The Mitre Tactics https://attack.mitre.org/ linked to the incident", "example": [ "TA0011" ] }, "techniques": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "description": "The Mitre Techniques https://attack.mitre.org/ linked to the incident", "example": [ "T1595" ] } }, "required": [ "observables", "targets" ] } } ], "tags": [ "v2", "Incident" ], "summary": "Process an incident update by invalidating the cache and finding reputations as well as resolving assets.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/{incident-id}/report": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "timeline": { "type": "object", "properties": { "ai_generated": { "type": "boolean" }, "content": { "type": "string", "minLength": 0, "maxLength": 2500, "x-nullable": true }, "created_at": { "type": "string", "format": "date-time" }, "error": { "type": "string", "minLength": 0, "maxLength": 2500, "x-nullable": true }, "failed": { "type": "boolean" }, "generating": { "type": "boolean" }, "section_id": { "type": "string", "enum": [ "timeline" ] }, "user_id": { "type": "string" }, "updated_at": { "type": "string", "format": "date-time", "x-nullable": true } }, "required": [ "ai_generated", "content", "created_at", "error", "failed", "generating", "section_id", "user_id", "updated_at" ] }, "executive": { "type": "object", "properties": { "ai_generated": { "type": "boolean" }, "content": { "type": "string", "minLength": 0, "maxLength": 2500, "x-nullable": true }, "created_at": { "type": "string", "format": "date-time" }, "error": { "type": "string", "minLength": 0, "maxLength": 2500, "x-nullable": true }, "failed": { "type": "boolean" }, "generating": { "type": "boolean" }, "section_id": { "type": "string", "enum": [ "executive" ] }, "user_id": { "type": "string" }, "updated_at": { "type": "string", "format": "date-time", "x-nullable": true } }, "required": [ "ai_generated", "content", "created_at", "error", "failed", "generating", "section_id", "user_id", "updated_at" ] }, "events": { "type": "object", "properties": { "ai_generated": { "type": "boolean" }, "content": { "type": "string", "minLength": 0, "maxLength": 2500, "x-nullable": true }, "created_at": { "type": "string", "format": "date-time" }, "error": { "type": "string", "minLength": 0, "maxLength": 2500, "x-nullable": true }, "failed": { "type": "boolean" }, "generating": { "type": "boolean" }, "section_id": { "type": "string", "enum": [ "events" ] }, "user_id": { "type": "string" }, "updated_at": { "type": "string", "format": "date-time", "x-nullable": true } }, "required": [ "ai_generated", "content", "created_at", "error", "failed", "generating", "section_id", "user_id", "updated_at" ] }, "incident": { "type": "object", "properties": { "ai_generated": { "type": "boolean" }, "content": { "type": "string", "minLength": 0, "maxLength": 2500, "x-nullable": true }, "created_at": { "type": "string", "format": "date-time" }, "error": { "type": "string", "minLength": 0, "maxLength": 2500, "x-nullable": true }, "failed": { "type": "boolean" }, "generating": { "type": "boolean" }, "section_id": { "type": "string", "enum": [ "incident" ] }, "user_id": { "type": "string" }, "updated_at": { "type": "string", "format": "date-time", "x-nullable": true } }, "required": [ "ai_generated", "content", "created_at", "error", "failed", "generating", "section_id", "user_id", "updated_at" ] } }, "required": [ "timeline", "executive", "events", "incident" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" }, { "in": "query", "name": "timezone", "description": "", "type": "string", "required": false, "example": "Antarctica/McMurdo" } ], "tags": [ "v2", "Incident", "Incident Report" ], "summary": "Incident Report", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/{incident-id}/report/{section-id}": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "ai_generated": { "type": "boolean" }, "content": { "type": "string", "minLength": 0, "maxLength": 2500, "x-nullable": true }, "created_at": { "type": "string", "format": "date-time" }, "error": { "type": "string", "minLength": 0, "maxLength": 2500, "x-nullable": true }, "failed": { "type": "boolean" }, "generating": { "type": "boolean" }, "section_id": { "type": "string", "enum": [ "timeline", "executive", "events", "incident" ] }, "user_id": { "type": "string" }, "updated_at": { "type": "string", "format": "date-time", "x-nullable": true } }, "required": [ "ai_generated", "content", "created_at", "error", "failed", "generating", "section_id", "user_id", "updated_at" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" }, { "in": "path", "name": "section-id", "description": "", "type": "string", "required": true, "enum": [ "timeline", "executive", "events", "incident" ] }, { "in": "query", "name": "timezone", "description": "", "type": "string", "required": false, "example": "Antarctica/McMurdo" } ], "tags": [ "v2", "Incident", "Incident Report" ], "summary": "Incident Report Section", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] }, "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "ai_generated": { "type": "boolean" }, "content": { "type": "string", "minLength": 0, "maxLength": 2500, "x-nullable": true }, "created_at": { "type": "string", "format": "date-time" }, "error": { "type": "string", "minLength": 0, "maxLength": 2500, "x-nullable": true }, "failed": { "type": "boolean" }, "generating": { "type": "boolean" }, "section_id": { "type": "string", "enum": [ "timeline", "executive", "events", "incident" ] }, "user_id": { "type": "string" }, "updated_at": { "type": "string", "format": "date-time", "x-nullable": true } }, "required": [ "ai_generated", "content", "created_at", "error", "failed", "generating", "section_id", "user_id", "updated_at" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" }, { "in": "path", "name": "section-id", "description": "", "type": "string", "required": true, "enum": [ "timeline", "executive", "events", "incident" ] }, { "in": "query", "name": "timezone", "description": "", "type": "string", "required": false, "example": "Antarctica/McMurdo" }, { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "content": { "type": "string", "minLength": 0, "maxLength": 2500, "x-nullable": true } }, "required": [ "content" ] } } ], "tags": [ "v2", "Incident", "Incident Report" ], "summary": "Update Report Section", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/{incident-id}/report/{section-id}/regenerate": { "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "ai_generated": { "type": "boolean" }, "content": { "type": "string", "minLength": 0, "maxLength": 2500, "x-nullable": true }, "created_at": { "type": "string", "format": "date-time" }, "error": { "type": "string", "minLength": 0, "maxLength": 2500, "x-nullable": true }, "failed": { "type": "boolean" }, "generating": { "type": "boolean" }, "section_id": { "type": "string", "enum": [ "timeline", "executive", "events", "incident" ] }, "user_id": { "type": "string" }, "updated_at": { "type": "string", "format": "date-time", "x-nullable": true } }, "required": [ "ai_generated", "content", "created_at", "error", "failed", "generating", "section_id", "user_id", "updated_at" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" }, { "in": "path", "name": "section-id", "description": "", "type": "string", "required": true, "enum": [ "timeline", "executive", "events", "incident" ] }, { "in": "query", "name": "timezone", "description": "", "type": "string", "required": false, "example": "Antarctica/McMurdo" } ], "tags": [ "v2", "Incident", "Incident Report" ], "summary": "Regenerate a Report Section", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/{incident-id}/summary": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "event_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "last_seen_event": { "type": "string", "format": "date-time", "x-nullable": true }, "first_seen_event": { "type": "string", "format": "date-time", "x-nullable": true }, "sources": { "type": "array", "items": { "type": "string" } }, "indicators": { "type": "object", "properties": { "total_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "producer": { "type": "string" }, "description": { "type": "string", "x-nullable": true }, "short_description": { "type": "string", "x-nullable": true }, "internal": { "type": "boolean" }, "source": { "type": "string", "x-nullable": true }, "source_uri": { "type": "string", "x-nullable": true }, "sources": { "type": "array", "items": { "type": "string" } }, "tags": { "type": "array", "items": { "type": "string" }, "x-nullable": true }, "title": { "type": "string", "x-nullable": true }, "value": { "type": "string" }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "id", "producer", "description", "short_description", "internal", "source", "source_uri", "sources", "tags", "title", "value", "count" ] } } }, "required": [ "total_count", "data" ] }, "observables": { "type": "object", "properties": { "total_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated", "count" ] } } }, "required": [ "total_count", "data" ] }, "targets": { "type": "object", "properties": { "total_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "type": { "title": "TargetTypeEnum", "type": "string", "enum": [ "device", "person", "user", "email", "endpoint.sensor", "process.network-scanner", "network.switch", "network.security_manager", "process.vulnerability-scanner", "network.hub", "network.ids", "network.firewall", "process", "network.sense_making", "process.sandbox", "network.modem", "process.email-service", "process.dns-server", "network.vpn", "process.connection-scanner", "network.nic", "endpoint.printer", "network.gateway", "process.reputation-service", "process.remediation-service", "network", "process.virtualization-service", "network.ips", "endpoint.smart-meter", "endpoint.digital-telephone-handset", "endpoint.workstation", "endpoint.server", "network.wap", "endpoint.laptop", "process.aaa-server", "process.directory-service", "endpoint.pos-terminal", "network.bridge", "process.file-scanner", "network.proxy", "endpoint", "process.location-service", "network.sensor", "endpoint.smart-phone", "network.hips", "process.anti-virus-scanner", "endpoint.tablet", "network.guard", "network.router" ], "example": "endpoint", "description": "The targe type/actuator that best fits the device." }, "value": { "title": "TargetSummary.Value", "type": "string", "example": "CARGO-Example", "description": "The targe type/actuator that best fits the device." }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The numerical value of the Device. Will Default to 10 if the Target is resolved.", "example": 2, "x-nullable": true, "default": 7 }, "is_asset": { "title": "TargetSummary.IsAssetEnum", "enum": [ true ], "type": "boolean", "example": true, "description": "Always true for targets." }, "observableType": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The observable type of the defining target observable" }, "observables": { "title": "TargetSummary.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true, "description": "The observable type of the defining target observable" }, "asset_id": { "title": "TargetSummary.AssetId", "type": "string", "example": "4911bbf5-aa42-463b-9a47-65f24140cfe4", "description": "The Device/User Insights ID of this Person or Device.", "x-nullable": true }, "properties": { "title": "TargetSummary.Properties", "type": "array", "items": { "type": "object", "properties": { "name": { "title": "Property.Name", "type": "string", "description": "An open vocabulary string that describes the name of the property.", "example": "cisco:ctr:labels" }, "value": { "title": "Property.Value", "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": {} } ], "description": "The value of the named property.", "example": [ "example label", 1, [ "it can be a string or an int or a vector of anything" ] ] } }, "required": [ "name", "value" ] }, "uniqueItems": true, "description": "The List of Device or Person properties for this resolved Person/Device." }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "type", "value", "is_asset", "observableType", "observables", "asset_id", "properties", "count" ] } } }, "required": [ "total_count", "data" ] }, "casebooks": { "type": "array", "items": { "type": "object", "properties": { "bundle": { "type": "object", "properties": { "id": { "type": "string" }, "description": { "type": "string" }, "attack_patterns": { "type": "array", "items": { "type": "object", "properties": {} } }, "assets": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_properties": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_mappings": { "type": "array", "items": { "type": "object", "properties": {} } }, "casebooks": { "type": "array", "items": { "type": "object", "properties": {} } }, "indicators": { "type": "array", "items": { "type": "object", "properties": {} } }, "judgements": { "type": "array", "items": { "type": "object", "properties": {} } }, "malwares": { "type": "array", "items": { "type": "object", "properties": {} } }, "modules": { "type": "array", "items": { "type": "object", "properties": {} } }, "relationships": { "type": "array", "items": { "type": "object", "properties": {} } }, "sightings": { "type": "array", "items": { "type": "object", "properties": {} } }, "verdicts": { "type": "array", "items": { "type": "object", "properties": {} } }, "tools": { "type": "array", "items": { "type": "object", "properties": {} } } } }, "texts": { "type": "array", "items": { "type": "object", "properties": { "text": { "type": "string" }, "type": { "type": "string" } }, "required": [ "text", "type" ] } }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "casebook" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "id", "groups", "schema_version", "type" ] } }, "incident": { "type": "object", "properties": { "assignees": { "type": "array", "items": { "type": "string" } }, "categories": { "type": "array", "items": { "type": "string", "enum": [ "Attrition", "Denial of Service", "Exercise", "Exercise/Network Defense Testing", "Explained Anomaly", "Forensics", "Improper Usage", "Intelligence", "Investigating", "Investigation", "Malicious Code", "Malicious Logic", "Non-Compliant", "Reconnaissance", "Root Level", "Scans/Probes/Attempted Access", "Unauthorized Access", "Unsuccessful", "User Level", "eDiscovery" ] } }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "detection_sources": { "type": "array", "items": { "type": "string" } }, "detection_status": { "title": "DetectionStatusType", "type": "string", "enum": [ "active", "inactive_merged", "inactive_expired", "inactive_oversized", "inactive_user_closed" ], "description": "Whether the incident is actively receiving detection data updates" }, "discovery_method": { "type": "string", "enum": [ "SecureX Threat Hunting", "Agent Disclosure", "Antivirus", "Audit", "Customer", "External - Fraud Detection", "Financial Audit", "HIPS", "IT Audit", "Incident Response", "Internal - Fraud Detection", "Law Enforcement", "Log Review", "Monitoring Service", "NIDS", "Security Alarm", "Unknown", "Unrelated Party", "User" ] }, "incident_time": { "type": "object", "properties": { "opened": { "type": "string" }, "closed": { "type": "string" }, "discovered": { "type": "string" }, "rejected": { "type": "string" }, "remediated": { "type": "string" }, "reported": { "type": "string" } }, "required": [ "opened" ] }, "intended_effect": { "type": "string", "enum": [ "Account Takeover", "Advantage", "Advantage - Economic", "Advantage - Military", "Advantage - Political", "Brand Damage", "Competitive Advantage", "Degradation of Service", "Denial and Deception", "Destruction", "Disruption", "Embarrassment", "Exposure", "Extortion", "Fraud", "Harassment", "ICS Control", "Theft", "Theft - Credential Theft", "Theft - Identity Theft", "Theft - Intellectual Property", "Theft - Theft of Proprietary Information", "Traffic Diversion", "Unauthorized Access" ] }, "meta": { "type": "object", "properties": { "ai_description": { "type": "boolean" }, "helios_report_generated": { "type": "boolean" } } }, "promotion_method": { "type": "string", "enum": [ "Automated", "Manual" ] }, "scores": { "type": "object", "properties": { "asset": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 10 }, "global": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 1000 }, "ml_score": { "type": "number", "format": "double" }, "ttp": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 100 } } }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_id": { "type": "string" }, "status": { "title": "IncidentStatusType", "type": "string", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ], "description": "The status of the incident" }, "tactics": { "type": "array", "items": { "type": "string" } }, "techniques": { "type": "array", "items": { "type": "string" } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "incident" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "confidence", "incident_time", "status", "id", "groups", "schema_version", "type" ] }, "linked_incidents": { "type": "array", "items": { "type": "object", "properties": { "assignees": { "type": "array", "items": { "type": "string" } }, "categories": { "type": "array", "items": { "type": "string", "enum": [ "Attrition", "Denial of Service", "Exercise", "Exercise/Network Defense Testing", "Explained Anomaly", "Forensics", "Improper Usage", "Intelligence", "Investigating", "Investigation", "Malicious Code", "Malicious Logic", "Non-Compliant", "Reconnaissance", "Root Level", "Scans/Probes/Attempted Access", "Unauthorized Access", "Unsuccessful", "User Level", "eDiscovery" ] } }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "detection_sources": { "type": "array", "items": { "type": "string" } }, "detection_status": { "title": "DetectionStatusType", "type": "string", "enum": [ "active", "inactive_merged", "inactive_expired", "inactive_oversized", "inactive_user_closed" ], "description": "Whether the incident is actively receiving detection data updates" }, "discovery_method": { "type": "string", "enum": [ "SecureX Threat Hunting", "Agent Disclosure", "Antivirus", "Audit", "Customer", "External - Fraud Detection", "Financial Audit", "HIPS", "IT Audit", "Incident Response", "Internal - Fraud Detection", "Law Enforcement", "Log Review", "Monitoring Service", "NIDS", "Security Alarm", "Unknown", "Unrelated Party", "User" ] }, "incident_time": { "type": "object", "properties": { "opened": { "type": "string" }, "closed": { "type": "string" }, "discovered": { "type": "string" }, "rejected": { "type": "string" }, "remediated": { "type": "string" }, "reported": { "type": "string" } }, "required": [ "opened" ] }, "intended_effect": { "type": "string", "enum": [ "Account Takeover", "Advantage", "Advantage - Economic", "Advantage - Military", "Advantage - Political", "Brand Damage", "Competitive Advantage", "Degradation of Service", "Denial and Deception", "Destruction", "Disruption", "Embarrassment", "Exposure", "Extortion", "Fraud", "Harassment", "ICS Control", "Theft", "Theft - Credential Theft", "Theft - Identity Theft", "Theft - Intellectual Property", "Theft - Theft of Proprietary Information", "Traffic Diversion", "Unauthorized Access" ] }, "meta": { "type": "object", "properties": { "ai_description": { "type": "boolean" }, "helios_report_generated": { "type": "boolean" } } }, "promotion_method": { "type": "string", "enum": [ "Automated", "Manual" ] }, "scores": { "type": "object", "properties": { "asset": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 10 }, "global": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 1000 }, "ml_score": { "type": "number", "format": "double" }, "ttp": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 100 } } }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_id": { "type": "string" }, "status": { "title": "IncidentStatusType", "type": "string", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ], "description": "The status of the incident" }, "tactics": { "type": "array", "items": { "type": "string" } }, "techniques": { "type": "array", "items": { "type": "string" } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "incident" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "confidence", "incident_time", "status", "id", "groups", "schema_version", "type" ] } }, "investigations": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "x-nullable": true }, "short_description": { "type": "string", "x-nullable": true }, "description": { "type": "string", "x-nullable": true }, "source": { "type": "string", "x-nullable": true } }, "required": [ "id", "short_description", "description", "source" ] } }, "linked_references": { "type": "object", "properties": { "investigation_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "incident_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "indicator_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "casebook_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "total": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "investigation_count", "incident_count", "indicator_count", "casebook_count", "total" ] }, "primary_investigation": { "type": "object", "properties": { "id": { "type": "string", "x-nullable": true }, "short_description": { "type": "string", "x-nullable": true }, "description": { "type": "string", "x-nullable": true }, "source": { "type": "string", "x-nullable": true } }, "required": [ "id", "short_description", "description", "source" ] }, "mitre_data": { "type": "object", "properties": { "total_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "enum": [ "TA0004", "TA0010", "TA0005", "TA0001", "TA0009", "TA0002", "TA0040", "TA0043", "TA0011", "TA0008", "TA0042", "TA0006", "TA0007", "TA0003" ] }, "value": { "type": "string", "enum": [ "TA0004", "TA0010", "TA0005", "TA0001", "TA0009", "TA0002", "TA0040", "TA0043", "TA0011", "TA0008", "TA0042", "TA0006", "TA0007", "TA0003" ] }, "phase_name": { "type": "string", "enum": [ "privilege-escalation", "exfiltration", "defense-evasion", "initial-access", "collection", "execution", "impact", "reconnaissance", "command-and-control", "lateral-movement", "resource-development", "credential-access", "discovery", "persistence" ] }, "priority": { "type": "integer", "enum": [ 6, 12, 7, 3, 10, 4, 13, 1, 11, 9, 2, 8, 8, 5 ] }, "url": { "type": "string", "enum": [ "https://attack.mitre.org/tactics/TA0004/", "https://attack.mitre.org/tactics/TA0010/", "https://attack.mitre.org/tactics/TA0005/", "https://attack.mitre.org/tactics/TA0001/", "https://attack.mitre.org/tactics/TA0009/", "https://attack.mitre.org/tactics/TA0002/", "https://attack.mitre.org/tactics/TA0040/", "https://attack.mitre.org/tactics/TA0043/", "https://attack.mitre.org/tactics/TA0011/", "https://attack.mitre.org/tactics/TA0008/", "https://attack.mitre.org/tactics/TA0042/", "https://attack.mitre.org/tactics/TA0006/", "https://attack.mitre.org/tactics/TA0007/", "https://attack.mitre.org/tactics/TA0003/" ] }, "title": { "type": "string", "enum": [ "Privilege Escalation", "Exfiltration", "Defense Evasion", "Initial Access", "Collection", "Execution", "Impact", "Reconnaissance", "Command and Control", "Lateral Movement", "Resource Development", "Credential Access", "Discovery", "Persistence" ] }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "id", "value", "phase_name", "priority", "url", "title", "count" ] } } }, "required": [ "total_count", "data" ] }, "short_id": { "type": "string", "x-nullable": true }, "source": { "type": "object", "properties": { "total_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string" }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "value", "count" ] } } }, "required": [ "total_count", "data" ] }, "severity": { "type": "object", "properties": { "total_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string" }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "value", "count" ] } } }, "required": [ "total_count", "data" ] } }, "required": [ "event_count", "last_seen_event", "first_seen_event", "sources", "indicators", "observables", "targets", "casebooks", "incident", "linked_incidents", "investigations", "linked_references", "primary_investigation", "mitre_data", "source", "severity" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v2", "Incident", "Incident Overview" ], "summary": "Full Incident Summary. Equivalent Data to v1 summary endpoints.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/{incident-id}/mitre": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "title": "Mitre tactics", "type": "object", "properties": { "id": { "title": "MitreID", "type": "string", "example": "TA0003", "description": "MITRE ATT&CK ID" }, "external_id": { "title": "MitreExternalId", "type": "string", "example": "TA0003", "description": "MITRE ATT&CK ID" }, "title": { "title": "MitreTitle", "type": "string", "example": "Persistence" }, "short_description": { "title": "MitreShortDescription", "type": "string", "x-nullable": true, "example": "Persistence" }, "description": { "title": "MitreDescription", "type": "string", "example": "The adversary is trying to maintain their foothold.\n\nPersistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code." }, "score": { "title": "MitreScore", "type": "integer", "format": "int64", "minimum": 1, "maximum": 1000, "x-nullable": true, "example": 44 }, "source_url": { "title": "MitreSourceURL", "type": "string", "x-nullable": true, "example": "https://attack.mitre.org/techniques/TA0003", "description": "The source url for this tactic or technique" }, "techniques": { "type": "array", "items": { "title": "Mitre techniques", "type": "object", "properties": { "id": { "title": "MitreID", "type": "string", "example": "T1078", "description": "MITRE ATT&CK ID" }, "external_id": { "title": "MitreExternalId", "type": "string", "example": "T1078", "description": "MITRE ATT&CK ID" }, "title": { "title": "MitreTitle", "type": "string", "example": "Account Manipulation" }, "short_description": { "title": "MitreShortDescription", "type": "string", "x-nullable": true, "example": "No short-description provided for MITRE Attack Pattern \"Account Manipulation\"." }, "description": { "title": "MitreDescription", "type": "string", "example": "Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. \n\nIn order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078)." }, "score": { "title": "MitreScore", "type": "integer", "format": "int64", "minimum": 1, "maximum": 1000, "x-nullable": true, "example": 68 }, "source_url": { "title": "MitreSourceURL", "type": "string", "x-nullable": true, "example": "https://attack.mitre.org/techniques/T1078", "description": "The source url for this tactic or technique" }, "subtechniques": { "type": "array", "items": { "title": "Mitre Sub-techniques", "type": "object", "properties": { "id": { "title": "MitreID", "type": "string", "example": "T1078.100", "description": "MITRE ATT&CK ID" }, "external_id": { "title": "MitreExternalId", "type": "string", "example": "T1078.100", "description": "MITRE ATT&CK ID" }, "title": { "title": "MitreTitle", "type": "string", "example": "Additional Cloud Credentials" }, "short_description": { "title": "MitreShortDescription", "type": "string", "x-nullable": true, "example": "No short-description provided for MITRE Attack Pattern \"Additional Cloud Credentials\"." }, "description": { "title": "MitreDescription", "type": "string", "example": "Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.\n\nFor example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure / Entra ID.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)\n\nIn infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)\n\nAdversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. Alternatively, they may use the CreateLoginProfile API in AWS to add a password that can be used to log into the AWS Management Console for [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538).(Citation: Permiso Scattered Spider 2023)(Citation: Lacework AI Resource Hijacking 2024) If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal\u2019s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) \n\nIn AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account\u2019s API credentials are deactivated.\n(Citation: Crowdstrike AWS User Federation Persistence)\n\nIn Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42 Operations 2024) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user\u2019s primary password is reset.(Citation: Microsoft Entra ID App Passwords)" }, "score": { "title": "MitreScore", "type": "integer", "format": "int64", "minimum": 1, "maximum": 1000, "x-nullable": true, "example": 67 }, "source_url": { "title": "MitreSourceURL", "type": "string", "x-nullable": true, "example": "https://attack.mitre.org/techniques/T1078/100", "description": "The source url for this tactic or technique" } }, "required": [ "id", "external_id", "title", "short_description", "description", "score", "source_url" ], "description": "A MITRE object from https://attack.mitre.org/" } } }, "required": [ "id", "external_id", "title", "short_description", "description", "score", "source_url", "subtechniques" ], "description": "A MITRE object from https://attack.mitre.org/" } } }, "required": [ "id", "external_id", "title", "short_description", "description", "score", "source_url", "techniques" ], "description": "A MITRE object from https://attack.mitre.org/" } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v2", "Incident", "Incident Overview" ], "summary": "Mitre tactics, techniques, and subtechniques found in an incident", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/{incident-id}/targets": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": { "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "type": { "title": "TargetTypeEnum", "type": "string", "enum": [ "device", "person", "user", "email", "endpoint.sensor", "process.network-scanner", "network.switch", "network.security_manager", "process.vulnerability-scanner", "network.hub", "network.ids", "network.firewall", "process", "network.sense_making", "process.sandbox", "network.modem", "process.email-service", "process.dns-server", "network.vpn", "process.connection-scanner", "network.nic", "endpoint.printer", "network.gateway", "process.reputation-service", "process.remediation-service", "network", "process.virtualization-service", "network.ips", "endpoint.smart-meter", "endpoint.digital-telephone-handset", "endpoint.workstation", "endpoint.server", "network.wap", "endpoint.laptop", "process.aaa-server", "process.directory-service", "endpoint.pos-terminal", "network.bridge", "process.file-scanner", "network.proxy", "endpoint", "process.location-service", "network.sensor", "endpoint.smart-phone", "network.hips", "process.anti-virus-scanner", "endpoint.tablet", "network.guard", "network.router" ], "example": "endpoint", "description": "The targe type/actuator that best fits the device." }, "value": { "title": "TargetSummary.Value", "type": "string", "example": "CARGO-Example", "description": "The targe type/actuator that best fits the device." }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The numerical value of the Device. Will Default to 10 if the Target is resolved.", "example": 2, "x-nullable": true, "default": 7 }, "is_asset": { "title": "TargetSummary.IsAssetEnum", "enum": [ true ], "type": "boolean", "example": true, "description": "Always true for targets." }, "observableType": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The observable type of the defining target observable" }, "observables": { "title": "TargetSummary.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true, "description": "The observable type of the defining target observable" }, "asset_id": { "title": "TargetSummary.AssetId", "type": "string", "example": "4911bbf5-aa42-463b-9a47-65f24140cfe4", "description": "The Device/User Insights ID of this Person or Device.", "x-nullable": true }, "properties": { "title": "TargetSummary.Properties", "type": "array", "items": { "type": "object", "properties": { "name": { "title": "Property.Name", "type": "string", "description": "An open vocabulary string that describes the name of the property.", "example": "cisco:ctr:labels" }, "value": { "title": "Property.Value", "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": {} } ], "description": "The value of the named property.", "example": [ "example label", 1, [ "it can be a string or an int or a vector of anything" ] ] } }, "required": [ "name", "value" ] }, "uniqueItems": true, "description": "The List of Device or Person properties for this resolved Person/Device." }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "type", "value", "is_asset", "observableType", "observables", "asset_id", "properties", "count" ] } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v2", "Incident", "Incident Overview" ], "summary": "Incident Assets", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/{incident-id}/observables": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated", "count" ] } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v2", "Incident", "Incident Overview" ], "summary": "Returns a list of observables linked to this incident.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/{incident-id}/indicators": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "producer": { "type": "string" }, "description": { "type": "string", "x-nullable": true }, "short_description": { "type": "string", "x-nullable": true }, "internal": { "type": "boolean" }, "source": { "type": "string", "x-nullable": true }, "source_uri": { "type": "string", "x-nullable": true }, "sources": { "type": "array", "items": { "type": "string" } }, "tags": { "type": "array", "items": { "type": "string" }, "x-nullable": true }, "title": { "type": "string", "x-nullable": true }, "value": { "type": "string" } }, "required": [ "id", "producer", "description", "short_description", "internal", "source", "source_uri", "sources", "tags", "title", "value" ] } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v2", "Incident", "Incident Overview" ], "summary": "Returns a list of indicators linked to this incident.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/{incident-id}/entities": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v2", "Incident", "Incident Overview" ], "summary": "Returns a list of entities associated with this incident.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] }, { "JWT-Bearer": [] } ] } }, "/v2/incident/{incident-id}/events": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "id": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "observed_time": { "type": "object", "properties": { "start_time": { "type": "string" }, "end_time": { "type": "string", "x-nullable": true } }, "required": [ "start_time" ] }, "type": { "type": "string", "enum": [ "sighting" ] }, "context": { "x-nullable": true }, "data": { "type": "object", "properties": { "columns": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "type": { "type": "string", "enum": [ "integer", "markdown", "number", "observable", "string", "url" ] }, "description": { "type": "string", "x-nullable": true }, "required": { "type": "boolean" }, "short_description": { "type": "string", "x-nullable": true } }, "required": [ "name", "type" ] } }, "rows": { "type": "array", "items": {} }, "row_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "columns", "rows" ] }, "external_ids": { "type": "array", "items": { "type": "string" } }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "internal": { "type": "boolean" }, "language": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "resolution": { "type": "string", "enum": [ "allowed", "blocked", "contained", "detected" ] }, "sensor": { "type": "string" }, "sensor_coordinates": { "type": "object", "properties": { "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "os": { "type": "string" }, "type": { "type": "string" } }, "required": [ "observables", "type" ] }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "timestamp": { "type": "string" }, "compacted_entities": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, "compacted_relations": { "type": "array", "items": { "type": "object", "properties": { "source": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "related": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "relation": { "type": "string" }, "origin": { "type": "string" } }, "required": [ "source", "related", "relation" ] }, "uniqueItems": true }, "title": { "type": "string", "x-nullable": true }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "notability": { "type": "object", "properties": { "first_seen_target": { "type": "object", "properties": { "label": { "type": "string" }, "targets": { "type": "array", "items": {}, "uniqueItems": true } }, "required": [ "label", "targets" ] }, "severity": { "type": "object", "properties": { "label": { "type": "string" } }, "required": [ "label" ] }, "mitre-attack": { "type": "object", "properties": { "label": { "type": "string" } }, "required": [ "label" ] }, "first_seen_indicator": { "type": "object", "properties": { "label": { "type": "string" }, "indicators": { "type": "array", "items": {}, "uniqueItems": true } }, "required": [ "label", "indicators" ] }, "original_event": { "type": "object", "properties": { "label": { "type": "string" } }, "required": [ "label" ] } } }, "mitreData": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "enum": [ "TA0004", "TA0010", "TA0005", "TA0001", "TA0009", "TA0002", "TA0040", "TA0043", "TA0011", "TA0008", "TA0042", "TA0006", "TA0007", "TA0003" ] }, "value": { "type": "string", "enum": [ "TA0004", "TA0010", "TA0005", "TA0001", "TA0009", "TA0002", "TA0040", "TA0043", "TA0011", "TA0008", "TA0042", "TA0006", "TA0007", "TA0003" ] }, "phase_name": { "type": "string", "enum": [ "privilege-escalation", "exfiltration", "defense-evasion", "initial-access", "collection", "execution", "impact", "reconnaissance", "command-and-control", "lateral-movement", "resource-development", "credential-access", "discovery", "persistence" ] }, "priority": { "type": "integer", "enum": [ 6, 12, 7, 3, 10, 4, 13, 1, 11, 9, 2, 8, 8, 5 ] }, "url": { "type": "string", "enum": [ "https://attack.mitre.org/tactics/TA0004/", "https://attack.mitre.org/tactics/TA0010/", "https://attack.mitre.org/tactics/TA0005/", "https://attack.mitre.org/tactics/TA0001/", "https://attack.mitre.org/tactics/TA0009/", "https://attack.mitre.org/tactics/TA0002/", "https://attack.mitre.org/tactics/TA0040/", "https://attack.mitre.org/tactics/TA0043/", "https://attack.mitre.org/tactics/TA0011/", "https://attack.mitre.org/tactics/TA0008/", "https://attack.mitre.org/tactics/TA0042/", "https://attack.mitre.org/tactics/TA0006/", "https://attack.mitre.org/tactics/TA0007/", "https://attack.mitre.org/tactics/TA0003/" ] }, "title": { "type": "string", "enum": [ "Privilege Escalation", "Exfiltration", "Defense Evasion", "Initial Access", "Collection", "Execution", "Impact", "Reconnaissance", "Command and Control", "Lateral Movement", "Resource Development", "Credential Access", "Discovery", "Persistence" ] } }, "required": [ "id", "value", "phase_name", "priority", "url", "title" ] }, "uniqueItems": true }, "notable": { "type": "boolean" }, "original": { "type": "boolean" }, "indicators": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "indicator" ], "example": "indicator", "description": "The fixed value indicator" }, "schema_version": { "type": "string", "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "x-nullable": true, "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "x-nullable": true, "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "x-nullable": true, "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "x-nullable": true, "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "The time range during which this Indicator is considered valid." }, "producer": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "Critical" }, "negate": { "type": "boolean", "example": true, "description": "Specifies the absence of the pattern." }, "indicator_type": { "type": "array", "items": { "type": "string", "enum": [ "Anonymization", "C2", "Compromised PKI Certificate", "Domain Watchlist", "Exfiltration", "File Hash Watchlist", "Host Characteristics", "IMEI Watchlist", "IMSI Watchlist", "IP Watchlist", "Login Name", "Malicious E-mail", "Malware Artifacts", "Private Threat Feed", "URL Watchlist" ], "example": "Anonymization" }, "example": [ "Anonymization" ], "description": "Specifies the type or types for this Indicator." }, "tags": { "type": "array", "items": { "type": "string" }, "x-nullable": true, "example": [ "string" ], "description": "Descriptors for this indicator." }, "composite_indicator_expression": { "type": "object", "properties": { "operator": { "type": "string", "enum": [ "and", "not", "or" ], "example": "and" }, "indicator_ids": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an indicator." }, "example": [ "string" ] } }, "required": [ "operator", "indicator_ids" ], "example": { "operator": "and", "indicator_ids": [ "string" ] } }, "likely_impact": { "type": "string", "example": "string", "description": "Likely potential impact within the relevant context if this Indicator were to occur." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "level of confidence held in the accuracy of this Indicator." }, "kill_chain_phases": { "type": "array", "items": { "type": "object", "properties": { "kill_chain_name": { "type": "string", "example": "string", "description": "The name of the kill chain." }, "phase_name": { "type": "string", "example": "string", "description": "The name of the phase in the kill chain." } }, "required": [ "kill_chain_name", "phase_name" ], "example": { "kill_chain_name": "string", "phase_name": "string" }, "description": "The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives." }, "example": [ { "kill_chain_name": "string", "phase_name": "string" } ], "description": "Relevant kill chain phases indicated by this Indicator." }, "test_mechanisms": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "example": [ "string" ], "description": "Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator." }, "specification": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Judgement" ], "example": "Judgement" }, "judgements": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to a judgement." }, "example": [ "string" ] }, "required_judgements": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "source": { "type": "string", "example": "string" }, "relationship": { "type": "string", "example": "string" }, "judgement_id": { "type": "string", "example": "string", "description": "A URI leading to a judgement." } }, "required": [ "judgement_id" ], "example": { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } }, "example": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "required": [ "type", "judgements", "required_judgements" ], "example": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] }, "description": "An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.", "x-anyOf": [ { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Judgement" ], "example": "Judgement" }, "judgements": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to a judgement." }, "example": [ "string" ] }, "required_judgements": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "source": { "type": "string", "example": "string" }, "relationship": { "type": "string", "example": "string" }, "judgement_id": { "type": "string", "example": "string", "description": "A URI leading to a judgement." } }, "required": [ "judgement_id" ], "example": { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } }, "example": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "required": [ "type", "judgements", "required_judgements" ], "example": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] }, "description": "An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "ThreatBrain" ], "example": "ThreatBrain" }, "query": { "type": "string", "example": "string" }, "variables": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ] } }, "required": [ "type", "variables" ], "example": { "type": "ThreatBrain", "query": "string", "variables": [ "string" ] }, "description": "An indicator which runs in threatbrain..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Snort" ], "example": "Snort" }, "snort_sig": { "type": "string", "example": "string" } }, "required": [ "type", "snort_sig" ], "example": { "type": "Snort", "snort_sig": "string" }, "description": "An indicator which runs in snort..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "SIOC" ], "example": "SIOC" }, "SIOC": { "type": "string", "example": "string" } }, "required": [ "type", "SIOC" ], "example": { "type": "SIOC", "SIOC": "string" }, "description": "An indicator which runs in snort..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "OpenIOC" ], "example": "OpenIOC" }, "open_IOC": { "type": "string", "example": "string" } }, "required": [ "type", "open_IOC" ], "example": { "type": "OpenIOC", "open_IOC": "string" }, "description": "An indicator which contains an XML blob of an openIOC indicator." } ] }, "value": { "title": "Event.Indicator.Value", "type": "string", "example": "W32.AdditionVariableCommandObfuscation.ioc", "description": "The canonical label for an indicator." } }, "required": [ "id", "producer", "value" ], "example": { "description": "string", "tags": [ "string" ], "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "producer": "string", "schema_version": "1.3.30", "revision": 10, "type": "indicator", "test_mechanisms": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "composite_indicator_expression": { "operator": "and", "indicator_ids": [ "string" ] }, "title": "string", "likely_impact": "string", "indicator_type": [ "Anonymization" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "severity": "Critical", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "negate": true, "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "specification": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "description": "An indicator is a test, or a collection of judgements that define\ncriteria for identifying the activity, or presence of malware, or\nother unwanted software.\n\nWe follow the\n[STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/)\nclosely, with the exception of not including observables within the\nindicator, and preferring a _specification_ object encoded in JSON as\nopposed to an opaque _implementation_ block.\n\nAdditional, you will want to either define judgements against\nObservables that are linked to this indicator, with the ID in the\n_indicators_ field of those Judgements, or you can provide a\n_specification_ value." } }, "investigationId": { "type": "string", "x-nullable": true }, "investigationShortDescription": { "type": "string", "x-nullable": true }, "investigationSource": { "type": "string", "x-nullable": true }, "targets": { "type": "array", "items": { "type": "object", "properties": { "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "type": { "title": "TargetTypeEnum", "type": "string", "enum": [ "device", "person", "user", "email", "endpoint.sensor", "process.network-scanner", "network.switch", "network.security_manager", "process.vulnerability-scanner", "network.hub", "network.ids", "network.firewall", "process", "network.sense_making", "process.sandbox", "network.modem", "process.email-service", "process.dns-server", "network.vpn", "process.connection-scanner", "network.nic", "endpoint.printer", "network.gateway", "process.reputation-service", "process.remediation-service", "network", "process.virtualization-service", "network.ips", "endpoint.smart-meter", "endpoint.digital-telephone-handset", "endpoint.workstation", "endpoint.server", "network.wap", "endpoint.laptop", "process.aaa-server", "process.directory-service", "endpoint.pos-terminal", "network.bridge", "process.file-scanner", "network.proxy", "endpoint", "process.location-service", "network.sensor", "endpoint.smart-phone", "network.hips", "process.anti-virus-scanner", "endpoint.tablet", "network.guard", "network.router" ], "example": "endpoint", "description": "The targe type/actuator that best fits the device." }, "value": { "title": "TargetSummary.Value", "type": "string", "example": "CARGO-Example", "description": "The targe type/actuator that best fits the device." }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The numerical value of the Device. Will Default to 10 if the Target is resolved.", "example": 2, "x-nullable": true, "default": 7 }, "is_asset": { "title": "TargetSummary.IsAssetEnum", "enum": [ true ], "type": "boolean", "example": true, "description": "Always true for targets." }, "observableType": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The observable type of the defining target observable" }, "observables": { "title": "TargetSummary.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true, "description": "The observable type of the defining target observable" }, "asset_id": { "title": "TargetSummary.AssetId", "type": "string", "example": "4911bbf5-aa42-463b-9a47-65f24140cfe4", "description": "The Device/User Insights ID of this Person or Device.", "x-nullable": true }, "properties": { "title": "TargetSummary.Properties", "type": "array", "items": { "type": "object", "properties": { "name": { "title": "Property.Name", "type": "string", "description": "An open vocabulary string that describes the name of the property.", "example": "cisco:ctr:labels" }, "value": { "title": "Property.Value", "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": {} } ], "description": "The value of the named property.", "example": [ "example label", 1, [ "it can be a string or an int or a vector of anything" ] ] } }, "required": [ "name", "value" ] }, "uniqueItems": true, "description": "The List of Device or Person properties for this resolved Person/Device." } }, "required": [ "type", "value", "is_asset", "observableType", "observables", "asset_id", "properties" ] } }, "relations": { "type": "array", "items": { "type": "object", "properties": { "origin": { "type": "string" }, "relation": { "type": "string" }, "related": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ], "x-anyOf": [ { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ] }, { "type": "object", "properties": { "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "type": { "title": "TargetTypeEnum", "type": "string", "enum": [ "device", "person", "user", "email", "endpoint.sensor", "process.network-scanner", "network.switch", "network.security_manager", "process.vulnerability-scanner", "network.hub", "network.ids", "network.firewall", "process", "network.sense_making", "process.sandbox", "network.modem", "process.email-service", "process.dns-server", "network.vpn", "process.connection-scanner", "network.nic", "endpoint.printer", "network.gateway", "process.reputation-service", "process.remediation-service", "network", "process.virtualization-service", "network.ips", "endpoint.smart-meter", "endpoint.digital-telephone-handset", "endpoint.workstation", "endpoint.server", "network.wap", "endpoint.laptop", "process.aaa-server", "process.directory-service", "endpoint.pos-terminal", "network.bridge", "process.file-scanner", "network.proxy", "endpoint", "process.location-service", "network.sensor", "endpoint.smart-phone", "network.hips", "process.anti-virus-scanner", "endpoint.tablet", "network.guard", "network.router" ], "example": "endpoint", "description": "The targe type/actuator that best fits the device." }, "value": { "title": "TargetSummary.Value", "type": "string", "example": "CARGO-Example", "description": "The targe type/actuator that best fits the device." }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The numerical value of the Device. Will Default to 10 if the Target is resolved.", "example": 2, "x-nullable": true, "default": 7 }, "is_asset": { "title": "TargetSummary.IsAssetEnum", "enum": [ true ], "type": "boolean", "example": true, "description": "Always true for targets." }, "observableType": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The observable type of the defining target observable" }, "observables": { "title": "TargetSummary.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true, "description": "The observable type of the defining target observable" }, "asset_id": { "title": "TargetSummary.AssetId", "type": "string", "example": "4911bbf5-aa42-463b-9a47-65f24140cfe4", "description": "The Device/User Insights ID of this Person or Device.", "x-nullable": true }, "properties": { "title": "TargetSummary.Properties", "type": "array", "items": { "type": "object", "properties": { "name": { "title": "Property.Name", "type": "string", "description": "An open vocabulary string that describes the name of the property.", "example": "cisco:ctr:labels" }, "value": { "title": "Property.Value", "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": {} } ], "description": "The value of the named property.", "example": [ "example label", 1, [ "it can be a string or an int or a vector of anything" ] ] } }, "required": [ "name", "value" ] }, "uniqueItems": true, "description": "The List of Device or Person properties for this resolved Person/Device." } }, "required": [ "type", "value", "is_asset", "observableType", "observables", "asset_id", "properties" ] } ] }, "source": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ], "x-anyOf": [ { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ] }, { "type": "object", "properties": { "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "type": { "title": "TargetTypeEnum", "type": "string", "enum": [ "device", "person", "user", "email", "endpoint.sensor", "process.network-scanner", "network.switch", "network.security_manager", "process.vulnerability-scanner", "network.hub", "network.ids", "network.firewall", "process", "network.sense_making", "process.sandbox", "network.modem", "process.email-service", "process.dns-server", "network.vpn", "process.connection-scanner", "network.nic", "endpoint.printer", "network.gateway", "process.reputation-service", "process.remediation-service", "network", "process.virtualization-service", "network.ips", "endpoint.smart-meter", "endpoint.digital-telephone-handset", "endpoint.workstation", "endpoint.server", "network.wap", "endpoint.laptop", "process.aaa-server", "process.directory-service", "endpoint.pos-terminal", "network.bridge", "process.file-scanner", "network.proxy", "endpoint", "process.location-service", "network.sensor", "endpoint.smart-phone", "network.hips", "process.anti-virus-scanner", "endpoint.tablet", "network.guard", "network.router" ], "example": "endpoint", "description": "The targe type/actuator that best fits the device." }, "value": { "title": "TargetSummary.Value", "type": "string", "example": "CARGO-Example", "description": "The targe type/actuator that best fits the device." }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The numerical value of the Device. Will Default to 10 if the Target is resolved.", "example": 2, "x-nullable": true, "default": 7 }, "is_asset": { "title": "TargetSummary.IsAssetEnum", "enum": [ true ], "type": "boolean", "example": true, "description": "Always true for targets." }, "observableType": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The observable type of the defining target observable" }, "observables": { "title": "TargetSummary.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true, "description": "The observable type of the defining target observable" }, "asset_id": { "title": "TargetSummary.AssetId", "type": "string", "example": "4911bbf5-aa42-463b-9a47-65f24140cfe4", "description": "The Device/User Insights ID of this Person or Device.", "x-nullable": true }, "properties": { "title": "TargetSummary.Properties", "type": "array", "items": { "type": "object", "properties": { "name": { "title": "Property.Name", "type": "string", "description": "An open vocabulary string that describes the name of the property.", "example": "cisco:ctr:labels" }, "value": { "title": "Property.Value", "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": {} } ], "description": "The value of the named property.", "example": [ "example label", 1, [ "it can be a string or an int or a vector of anything" ] ] } }, "required": [ "name", "value" ] }, "uniqueItems": true, "description": "The List of Device or Person properties for this resolved Person/Device." } }, "required": [ "type", "value", "is_asset", "observableType", "observables", "asset_id", "properties" ] } ] }, "origin_uri": { "type": "string" }, "relation_info": {} }, "required": [ "origin", "relation", "related", "source" ] } }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ] } }, "tactics_and_techniques": { "type": "array", "items": { "title": "Mitre tactics and Techniques", "type": "object", "properties": { "id": { "title": "MitreID", "type": "string", "example": "TA0003", "description": "MITRE ATT&CK ID" }, "external_id": { "title": "MitreExternalId", "type": "string", "example": "TA0003", "description": "MITRE ATT&CK ID" }, "title": { "title": "MitreTitle", "type": "string", "example": "Persistence" }, "short_description": { "title": "MitreShortDescription", "type": "string", "x-nullable": true, "example": "Persistence" }, "description": { "title": "MitreDescription", "type": "string", "example": "The adversary is trying to maintain their foothold.\n\nPersistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code." }, "score": { "title": "MitreScore", "type": "integer", "format": "int64", "minimum": 1, "maximum": 1000, "x-nullable": true, "example": 44 }, "source_url": { "title": "MitreSourceURL", "type": "string", "x-nullable": true, "example": "https://attack.mitre.org/techniques/TA0003", "description": "The source url for this tactic or technique" }, "mitre_type": { "type": "string", "enum": [ "tactic", "technique", "subtechnique" ] } }, "required": [ "id", "external_id", "title", "short_description", "description", "score", "source_url", "mitre_type" ], "description": "A MITRE object from https://attack.mitre.org/" } } }, "required": [ "confidence", "count", "id", "observed_time", "type", "notable", "original", "targets", "relations", "observables" ] } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" }, { "description": "A integer greater than 0.", "format": "int64", "name": "limit", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "description": "A integer greater than 0.", "format": "int64", "name": "offset", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "in": "query", "name": "sort", "description": "", "type": "string", "required": false, "enum": [ "asc", "desc" ], "allowEmptyValue": true }, { "in": "query", "name": "order", "description": "", "type": "string", "required": false, "enum": [ "start_time", "time", "title", "severity", "source" ], "allowEmptyValue": true }, { "in": "query", "name": "important_only", "description": "Include only important events", "type": "boolean", "required": false }, { "in": "query", "name": "notable", "description": "", "type": "boolean", "required": false }, { "in": "query", "name": "source", "description": "", "type": "array", "required": false, "items": { "type": "string" }, "x-anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "string", "allowEmptyValue": true } ] }, { "in": "query", "name": "severity", "description": "", "type": "array", "required": false, "items": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "x-anyOf": [ { "type": "array", "items": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] } }, { "type": "string", "allowEmptyValue": true } ] }, { "in": "query", "name": "type", "description": "", "type": "array", "required": false, "items": { "type": "string", "enum": [ "Original", "Investigated" ] }, "x-anyOf": [ { "type": "array", "items": { "type": "string", "enum": [ "Original", "Investigated" ] } }, { "type": "string", "allowEmptyValue": true } ] }, { "in": "query", "name": "search_text", "description": "", "type": "string", "required": false } ], "tags": [ "v2", "Incident", "Incident Overview" ], "summary": "Returns a list of events linked to this incident.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] }, { "JWT-Bearer": [] } ] }, "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "id": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "observed_time": { "type": "object", "properties": { "start_time": { "type": "string" }, "end_time": { "type": "string", "x-nullable": true } }, "required": [ "start_time" ] }, "type": { "type": "string", "enum": [ "sighting" ] }, "context": { "x-nullable": true }, "data": { "type": "object", "properties": { "columns": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "type": { "type": "string", "enum": [ "integer", "markdown", "number", "observable", "string", "url" ] }, "description": { "type": "string", "x-nullable": true }, "required": { "type": "boolean" }, "short_description": { "type": "string", "x-nullable": true } }, "required": [ "name", "type" ] } }, "rows": { "type": "array", "items": {} }, "row_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "columns", "rows" ] }, "external_ids": { "type": "array", "items": { "type": "string" } }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "internal": { "type": "boolean" }, "language": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "resolution": { "type": "string", "enum": [ "allowed", "blocked", "contained", "detected" ] }, "sensor": { "type": "string" }, "sensor_coordinates": { "type": "object", "properties": { "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "os": { "type": "string" }, "type": { "type": "string" } }, "required": [ "observables", "type" ] }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "timestamp": { "type": "string" }, "compacted_entities": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, "compacted_relations": { "type": "array", "items": { "type": "object", "properties": { "source": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "related": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "relation": { "type": "string" }, "origin": { "type": "string" } }, "required": [ "source", "related", "relation" ] }, "uniqueItems": true }, "title": { "type": "string", "x-nullable": true }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "notability": { "type": "object", "properties": { "first_seen_target": { "type": "object", "properties": { "label": { "type": "string" }, "targets": { "type": "array", "items": {}, "uniqueItems": true } }, "required": [ "label", "targets" ] }, "severity": { "type": "object", "properties": { "label": { "type": "string" } }, "required": [ "label" ] }, "mitre-attack": { "type": "object", "properties": { "label": { "type": "string" } }, "required": [ "label" ] }, "first_seen_indicator": { "type": "object", "properties": { "label": { "type": "string" }, "indicators": { "type": "array", "items": {}, "uniqueItems": true } }, "required": [ "label", "indicators" ] }, "original_event": { "type": "object", "properties": { "label": { "type": "string" } }, "required": [ "label" ] } } }, "mitreData": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "enum": [ "TA0004", "TA0010", "TA0005", "TA0001", "TA0009", "TA0002", "TA0040", "TA0043", "TA0011", "TA0008", "TA0042", "TA0006", "TA0007", "TA0003" ] }, "value": { "type": "string", "enum": [ "TA0004", "TA0010", "TA0005", "TA0001", "TA0009", "TA0002", "TA0040", "TA0043", "TA0011", "TA0008", "TA0042", "TA0006", "TA0007", "TA0003" ] }, "phase_name": { "type": "string", "enum": [ "privilege-escalation", "exfiltration", "defense-evasion", "initial-access", "collection", "execution", "impact", "reconnaissance", "command-and-control", "lateral-movement", "resource-development", "credential-access", "discovery", "persistence" ] }, "priority": { "type": "integer", "enum": [ 6, 12, 7, 3, 10, 4, 13, 1, 11, 9, 2, 8, 8, 5 ] }, "url": { "type": "string", "enum": [ "https://attack.mitre.org/tactics/TA0004/", "https://attack.mitre.org/tactics/TA0010/", "https://attack.mitre.org/tactics/TA0005/", "https://attack.mitre.org/tactics/TA0001/", "https://attack.mitre.org/tactics/TA0009/", "https://attack.mitre.org/tactics/TA0002/", "https://attack.mitre.org/tactics/TA0040/", "https://attack.mitre.org/tactics/TA0043/", "https://attack.mitre.org/tactics/TA0011/", "https://attack.mitre.org/tactics/TA0008/", "https://attack.mitre.org/tactics/TA0042/", "https://attack.mitre.org/tactics/TA0006/", "https://attack.mitre.org/tactics/TA0007/", "https://attack.mitre.org/tactics/TA0003/" ] }, "title": { "type": "string", "enum": [ "Privilege Escalation", "Exfiltration", "Defense Evasion", "Initial Access", "Collection", "Execution", "Impact", "Reconnaissance", "Command and Control", "Lateral Movement", "Resource Development", "Credential Access", "Discovery", "Persistence" ] } }, "required": [ "id", "value", "phase_name", "priority", "url", "title" ] }, "uniqueItems": true }, "notable": { "type": "boolean" }, "original": { "type": "boolean" }, "indicators": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "indicator" ], "example": "indicator", "description": "The fixed value indicator" }, "schema_version": { "type": "string", "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "x-nullable": true, "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "x-nullable": true, "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "x-nullable": true, "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "x-nullable": true, "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "The time range during which this Indicator is considered valid." }, "producer": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "Critical" }, "negate": { "type": "boolean", "example": true, "description": "Specifies the absence of the pattern." }, "indicator_type": { "type": "array", "items": { "type": "string", "enum": [ "Anonymization", "C2", "Compromised PKI Certificate", "Domain Watchlist", "Exfiltration", "File Hash Watchlist", "Host Characteristics", "IMEI Watchlist", "IMSI Watchlist", "IP Watchlist", "Login Name", "Malicious E-mail", "Malware Artifacts", "Private Threat Feed", "URL Watchlist" ], "example": "Anonymization" }, "example": [ "Anonymization" ], "description": "Specifies the type or types for this Indicator." }, "tags": { "type": "array", "items": { "type": "string" }, "x-nullable": true, "example": [ "string" ], "description": "Descriptors for this indicator." }, "composite_indicator_expression": { "type": "object", "properties": { "operator": { "type": "string", "enum": [ "and", "not", "or" ], "example": "and" }, "indicator_ids": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an indicator." }, "example": [ "string" ] } }, "required": [ "operator", "indicator_ids" ], "example": { "operator": "and", "indicator_ids": [ "string" ] } }, "likely_impact": { "type": "string", "example": "string", "description": "Likely potential impact within the relevant context if this Indicator were to occur." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "level of confidence held in the accuracy of this Indicator." }, "kill_chain_phases": { "type": "array", "items": { "type": "object", "properties": { "kill_chain_name": { "type": "string", "example": "string", "description": "The name of the kill chain." }, "phase_name": { "type": "string", "example": "string", "description": "The name of the phase in the kill chain." } }, "required": [ "kill_chain_name", "phase_name" ], "example": { "kill_chain_name": "string", "phase_name": "string" }, "description": "The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives." }, "example": [ { "kill_chain_name": "string", "phase_name": "string" } ], "description": "Relevant kill chain phases indicated by this Indicator." }, "test_mechanisms": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "example": [ "string" ], "description": "Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator." }, "specification": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Judgement" ], "example": "Judgement" }, "judgements": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to a judgement." }, "example": [ "string" ] }, "required_judgements": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "source": { "type": "string", "example": "string" }, "relationship": { "type": "string", "example": "string" }, "judgement_id": { "type": "string", "example": "string", "description": "A URI leading to a judgement." } }, "required": [ "judgement_id" ], "example": { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } }, "example": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "required": [ "type", "judgements", "required_judgements" ], "example": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] }, "description": "An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.", "x-anyOf": [ { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Judgement" ], "example": "Judgement" }, "judgements": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to a judgement." }, "example": [ "string" ] }, "required_judgements": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "source": { "type": "string", "example": "string" }, "relationship": { "type": "string", "example": "string" }, "judgement_id": { "type": "string", "example": "string", "description": "A URI leading to a judgement." } }, "required": [ "judgement_id" ], "example": { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } }, "example": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "required": [ "type", "judgements", "required_judgements" ], "example": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] }, "description": "An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "ThreatBrain" ], "example": "ThreatBrain" }, "query": { "type": "string", "example": "string" }, "variables": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ] } }, "required": [ "type", "variables" ], "example": { "type": "ThreatBrain", "query": "string", "variables": [ "string" ] }, "description": "An indicator which runs in threatbrain..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Snort" ], "example": "Snort" }, "snort_sig": { "type": "string", "example": "string" } }, "required": [ "type", "snort_sig" ], "example": { "type": "Snort", "snort_sig": "string" }, "description": "An indicator which runs in snort..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "SIOC" ], "example": "SIOC" }, "SIOC": { "type": "string", "example": "string" } }, "required": [ "type", "SIOC" ], "example": { "type": "SIOC", "SIOC": "string" }, "description": "An indicator which runs in snort..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "OpenIOC" ], "example": "OpenIOC" }, "open_IOC": { "type": "string", "example": "string" } }, "required": [ "type", "open_IOC" ], "example": { "type": "OpenIOC", "open_IOC": "string" }, "description": "An indicator which contains an XML blob of an openIOC indicator." } ] }, "value": { "title": "Event.Indicator.Value", "type": "string", "example": "W32.AdditionVariableCommandObfuscation.ioc", "description": "The canonical label for an indicator." } }, "required": [ "id", "producer", "value" ], "example": { "description": "string", "tags": [ "string" ], "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "producer": "string", "schema_version": "1.3.30", "revision": 10, "type": "indicator", "test_mechanisms": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "composite_indicator_expression": { "operator": "and", "indicator_ids": [ "string" ] }, "title": "string", "likely_impact": "string", "indicator_type": [ "Anonymization" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "severity": "Critical", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "negate": true, "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "specification": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "description": "An indicator is a test, or a collection of judgements that define\ncriteria for identifying the activity, or presence of malware, or\nother unwanted software.\n\nWe follow the\n[STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/)\nclosely, with the exception of not including observables within the\nindicator, and preferring a _specification_ object encoded in JSON as\nopposed to an opaque _implementation_ block.\n\nAdditional, you will want to either define judgements against\nObservables that are linked to this indicator, with the ID in the\n_indicators_ field of those Judgements, or you can provide a\n_specification_ value." } }, "investigationId": { "type": "string", "x-nullable": true }, "investigationShortDescription": { "type": "string", "x-nullable": true }, "investigationSource": { "type": "string", "x-nullable": true }, "targets": { "type": "array", "items": { "type": "object", "properties": { "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "type": { "title": "TargetTypeEnum", "type": "string", "enum": [ "device", "person", "user", "email", "endpoint.sensor", "process.network-scanner", "network.switch", "network.security_manager", "process.vulnerability-scanner", "network.hub", "network.ids", "network.firewall", "process", "network.sense_making", "process.sandbox", "network.modem", "process.email-service", "process.dns-server", "network.vpn", "process.connection-scanner", "network.nic", "endpoint.printer", "network.gateway", "process.reputation-service", "process.remediation-service", "network", "process.virtualization-service", "network.ips", "endpoint.smart-meter", "endpoint.digital-telephone-handset", "endpoint.workstation", "endpoint.server", "network.wap", "endpoint.laptop", "process.aaa-server", "process.directory-service", "endpoint.pos-terminal", "network.bridge", "process.file-scanner", "network.proxy", "endpoint", "process.location-service", "network.sensor", "endpoint.smart-phone", "network.hips", "process.anti-virus-scanner", "endpoint.tablet", "network.guard", "network.router" ], "example": "endpoint", "description": "The targe type/actuator that best fits the device." }, "value": { "title": "TargetSummary.Value", "type": "string", "example": "CARGO-Example", "description": "The targe type/actuator that best fits the device." }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The numerical value of the Device. Will Default to 10 if the Target is resolved.", "example": 2, "x-nullable": true, "default": 7 }, "is_asset": { "title": "TargetSummary.IsAssetEnum", "enum": [ true ], "type": "boolean", "example": true, "description": "Always true for targets." }, "observableType": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The observable type of the defining target observable" }, "observables": { "title": "TargetSummary.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true, "description": "The observable type of the defining target observable" }, "asset_id": { "title": "TargetSummary.AssetId", "type": "string", "example": "4911bbf5-aa42-463b-9a47-65f24140cfe4", "description": "The Device/User Insights ID of this Person or Device.", "x-nullable": true }, "properties": { "title": "TargetSummary.Properties", "type": "array", "items": { "type": "object", "properties": { "name": { "title": "Property.Name", "type": "string", "description": "An open vocabulary string that describes the name of the property.", "example": "cisco:ctr:labels" }, "value": { "title": "Property.Value", "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": {} } ], "description": "The value of the named property.", "example": [ "example label", 1, [ "it can be a string or an int or a vector of anything" ] ] } }, "required": [ "name", "value" ] }, "uniqueItems": true, "description": "The List of Device or Person properties for this resolved Person/Device." } }, "required": [ "type", "value", "is_asset", "observableType", "observables", "asset_id", "properties" ] } }, "relations": { "type": "array", "items": { "type": "object", "properties": { "origin": { "type": "string" }, "relation": { "type": "string" }, "related": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ], "x-anyOf": [ { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ] }, { "type": "object", "properties": { "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "type": { "title": "TargetTypeEnum", "type": "string", "enum": [ "device", "person", "user", "email", "endpoint.sensor", "process.network-scanner", "network.switch", "network.security_manager", "process.vulnerability-scanner", "network.hub", "network.ids", "network.firewall", "process", "network.sense_making", "process.sandbox", "network.modem", "process.email-service", "process.dns-server", "network.vpn", "process.connection-scanner", "network.nic", "endpoint.printer", "network.gateway", "process.reputation-service", "process.remediation-service", "network", "process.virtualization-service", "network.ips", "endpoint.smart-meter", "endpoint.digital-telephone-handset", "endpoint.workstation", "endpoint.server", "network.wap", "endpoint.laptop", "process.aaa-server", "process.directory-service", "endpoint.pos-terminal", "network.bridge", "process.file-scanner", "network.proxy", "endpoint", "process.location-service", "network.sensor", "endpoint.smart-phone", "network.hips", "process.anti-virus-scanner", "endpoint.tablet", "network.guard", "network.router" ], "example": "endpoint", "description": "The targe type/actuator that best fits the device." }, "value": { "title": "TargetSummary.Value", "type": "string", "example": "CARGO-Example", "description": "The targe type/actuator that best fits the device." }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The numerical value of the Device. Will Default to 10 if the Target is resolved.", "example": 2, "x-nullable": true, "default": 7 }, "is_asset": { "title": "TargetSummary.IsAssetEnum", "enum": [ true ], "type": "boolean", "example": true, "description": "Always true for targets." }, "observableType": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The observable type of the defining target observable" }, "observables": { "title": "TargetSummary.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true, "description": "The observable type of the defining target observable" }, "asset_id": { "title": "TargetSummary.AssetId", "type": "string", "example": "4911bbf5-aa42-463b-9a47-65f24140cfe4", "description": "The Device/User Insights ID of this Person or Device.", "x-nullable": true }, "properties": { "title": "TargetSummary.Properties", "type": "array", "items": { "type": "object", "properties": { "name": { "title": "Property.Name", "type": "string", "description": "An open vocabulary string that describes the name of the property.", "example": "cisco:ctr:labels" }, "value": { "title": "Property.Value", "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": {} } ], "description": "The value of the named property.", "example": [ "example label", 1, [ "it can be a string or an int or a vector of anything" ] ] } }, "required": [ "name", "value" ] }, "uniqueItems": true, "description": "The List of Device or Person properties for this resolved Person/Device." } }, "required": [ "type", "value", "is_asset", "observableType", "observables", "asset_id", "properties" ] } ] }, "source": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ], "x-anyOf": [ { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ] }, { "type": "object", "properties": { "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "type": { "title": "TargetTypeEnum", "type": "string", "enum": [ "device", "person", "user", "email", "endpoint.sensor", "process.network-scanner", "network.switch", "network.security_manager", "process.vulnerability-scanner", "network.hub", "network.ids", "network.firewall", "process", "network.sense_making", "process.sandbox", "network.modem", "process.email-service", "process.dns-server", "network.vpn", "process.connection-scanner", "network.nic", "endpoint.printer", "network.gateway", "process.reputation-service", "process.remediation-service", "network", "process.virtualization-service", "network.ips", "endpoint.smart-meter", "endpoint.digital-telephone-handset", "endpoint.workstation", "endpoint.server", "network.wap", "endpoint.laptop", "process.aaa-server", "process.directory-service", "endpoint.pos-terminal", "network.bridge", "process.file-scanner", "network.proxy", "endpoint", "process.location-service", "network.sensor", "endpoint.smart-phone", "network.hips", "process.anti-virus-scanner", "endpoint.tablet", "network.guard", "network.router" ], "example": "endpoint", "description": "The targe type/actuator that best fits the device." }, "value": { "title": "TargetSummary.Value", "type": "string", "example": "CARGO-Example", "description": "The targe type/actuator that best fits the device." }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The numerical value of the Device. Will Default to 10 if the Target is resolved.", "example": 2, "x-nullable": true, "default": 7 }, "is_asset": { "title": "TargetSummary.IsAssetEnum", "enum": [ true ], "type": "boolean", "example": true, "description": "Always true for targets." }, "observableType": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The observable type of the defining target observable" }, "observables": { "title": "TargetSummary.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true, "description": "The observable type of the defining target observable" }, "asset_id": { "title": "TargetSummary.AssetId", "type": "string", "example": "4911bbf5-aa42-463b-9a47-65f24140cfe4", "description": "The Device/User Insights ID of this Person or Device.", "x-nullable": true }, "properties": { "title": "TargetSummary.Properties", "type": "array", "items": { "type": "object", "properties": { "name": { "title": "Property.Name", "type": "string", "description": "An open vocabulary string that describes the name of the property.", "example": "cisco:ctr:labels" }, "value": { "title": "Property.Value", "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": {} } ], "description": "The value of the named property.", "example": [ "example label", 1, [ "it can be a string or an int or a vector of anything" ] ] } }, "required": [ "name", "value" ] }, "uniqueItems": true, "description": "The List of Device or Person properties for this resolved Person/Device." } }, "required": [ "type", "value", "is_asset", "observableType", "observables", "asset_id", "properties" ] } ] }, "origin_uri": { "type": "string" }, "relation_info": {} }, "required": [ "origin", "relation", "related", "source" ] } }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ] } }, "tactics_and_techniques": { "type": "array", "items": { "title": "Mitre tactics and Techniques", "type": "object", "properties": { "id": { "title": "MitreID", "type": "string", "example": "TA0003", "description": "MITRE ATT&CK ID" }, "external_id": { "title": "MitreExternalId", "type": "string", "example": "TA0003", "description": "MITRE ATT&CK ID" }, "title": { "title": "MitreTitle", "type": "string", "example": "Persistence" }, "short_description": { "title": "MitreShortDescription", "type": "string", "x-nullable": true, "example": "Persistence" }, "description": { "title": "MitreDescription", "type": "string", "example": "The adversary is trying to maintain their foothold.\n\nPersistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code." }, "score": { "title": "MitreScore", "type": "integer", "format": "int64", "minimum": 1, "maximum": 1000, "x-nullable": true, "example": 44 }, "source_url": { "title": "MitreSourceURL", "type": "string", "x-nullable": true, "example": "https://attack.mitre.org/techniques/TA0003", "description": "The source url for this tactic or technique" }, "mitre_type": { "type": "string", "enum": [ "tactic", "technique", "subtechnique" ] } }, "required": [ "id", "external_id", "title", "short_description", "description", "score", "source_url", "mitre_type" ], "description": "A MITRE object from https://attack.mitre.org/" } } }, "required": [ "confidence", "count", "id", "observed_time", "type", "notable", "original", "targets", "relations", "observables" ] } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" }, { "description": "A integer greater than 0.", "format": "int64", "name": "limit", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "description": "A integer greater than 0.", "format": "int64", "name": "offset", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "in": "query", "name": "sort", "description": "", "type": "string", "required": false, "enum": [ "asc", "desc" ], "allowEmptyValue": true }, { "in": "query", "name": "order", "description": "", "type": "string", "required": false, "enum": [ "start_time", "time", "title", "severity", "source" ], "allowEmptyValue": true }, { "in": "query", "name": "important_only", "description": "Include only important events", "type": "boolean", "required": false }, { "in": "query", "name": "notable", "description": "", "type": "boolean", "required": false }, { "in": "query", "name": "source", "description": "", "type": "array", "required": false, "items": { "type": "string" }, "x-anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "string", "allowEmptyValue": true } ] }, { "in": "query", "name": "severity", "description": "", "type": "array", "required": false, "items": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "x-anyOf": [ { "type": "array", "items": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] } }, { "type": "string", "allowEmptyValue": true } ] }, { "in": "query", "name": "type", "description": "", "type": "array", "required": false, "items": { "type": "string", "enum": [ "Original", "Investigated" ] }, "x-anyOf": [ { "type": "array", "items": { "type": "string", "enum": [ "Original", "Investigated" ] } }, { "type": "string", "allowEmptyValue": true } ] }, { "in": "query", "name": "search_text", "description": "", "type": "string", "required": false }, { "in": "body", "name": "body", "description": "", "required": false, "schema": { "type": "object", "properties": { "sightings": { "type": "array", "items": { "type": "string" }, "description": "sighting_ids for requested events", "example": [ "0a38949f-d192-4d30-91ae-e593c1f57c14" ] } }, "x-nullable": true } } ], "tags": [ "v2", "Incident", "Incident Overview" ], "summary": "Returns a list of events linked to this incident.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] }, { "JWT-Bearer": [] } ] } }, "/v2/incident/{incident-id}/status": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "completed": { "type": "integer", "format": "int64" }, "pending": { "type": "integer", "format": "int64" }, "sightings": { "type": "integer", "format": "int64" }, "indicators": { "type": "integer", "format": "int64" }, "verdicts": { "type": "integer", "format": "int64" }, "incident_id": { "type": "string", "format": "uuid" }, "short_id": { "type": "string", "x-nullable": true } }, "required": [ "completed", "pending", "sightings", "indicators", "verdicts", "incident_id" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v2", "Incident", "Incident Overview" ], "summary": "Returns the underlying incident's investigation status with surrounding threat context.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] }, "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "assignees": { "type": "array", "items": { "type": "string" } }, "categories": { "type": "array", "items": { "type": "string", "enum": [ "Attrition", "Denial of Service", "Exercise", "Exercise/Network Defense Testing", "Explained Anomaly", "Forensics", "Improper Usage", "Intelligence", "Investigating", "Investigation", "Malicious Code", "Malicious Logic", "Non-Compliant", "Reconnaissance", "Root Level", "Scans/Probes/Attempted Access", "Unauthorized Access", "Unsuccessful", "User Level", "eDiscovery" ] } }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "detection_sources": { "type": "array", "items": { "type": "string" } }, "detection_status": { "title": "DetectionStatusType", "type": "string", "enum": [ "active", "inactive_merged", "inactive_expired", "inactive_oversized", "inactive_user_closed" ], "description": "Whether the incident is actively receiving detection data updates" }, "discovery_method": { "type": "string", "enum": [ "SecureX Threat Hunting", "Agent Disclosure", "Antivirus", "Audit", "Customer", "External - Fraud Detection", "Financial Audit", "HIPS", "IT Audit", "Incident Response", "Internal - Fraud Detection", "Law Enforcement", "Log Review", "Monitoring Service", "NIDS", "Security Alarm", "Unknown", "Unrelated Party", "User" ] }, "incident_time": { "type": "object", "properties": { "opened": { "type": "string" }, "closed": { "type": "string" }, "discovered": { "type": "string" }, "rejected": { "type": "string" }, "remediated": { "type": "string" }, "reported": { "type": "string" } }, "required": [ "opened" ] }, "intended_effect": { "type": "string", "enum": [ "Account Takeover", "Advantage", "Advantage - Economic", "Advantage - Military", "Advantage - Political", "Brand Damage", "Competitive Advantage", "Degradation of Service", "Denial and Deception", "Destruction", "Disruption", "Embarrassment", "Exposure", "Extortion", "Fraud", "Harassment", "ICS Control", "Theft", "Theft - Credential Theft", "Theft - Identity Theft", "Theft - Intellectual Property", "Theft - Theft of Proprietary Information", "Traffic Diversion", "Unauthorized Access" ] }, "meta": { "type": "object", "properties": { "ai_description": { "type": "boolean" }, "helios_report_generated": { "type": "boolean" } } }, "promotion_method": { "type": "string", "enum": [ "Automated", "Manual" ] }, "scores": { "type": "object", "properties": { "asset": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 10 }, "global": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 1000 }, "ml_score": { "type": "number", "format": "double" }, "ttp": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 100 } } }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_id": { "type": "string" }, "status": { "title": "IncidentStatusType", "type": "string", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ], "description": "The status of the incident" }, "tactics": { "type": "array", "items": { "type": "string" } }, "techniques": { "type": "array", "items": { "type": "string" } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "incident" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "confidence", "incident_time", "status", "id", "groups", "schema_version", "type" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" }, { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "status": { "title": "IncidentStatusType", "type": "string", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ], "description": "The status of the incident" } }, "required": [ "status" ] } } ], "tags": [ "v2", "Incident", "Incident Overview" ], "summary": "Update an incident status.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/{incident-id}/event-filters": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "severity": { "type": "array", "items": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "x-nullable": true }, "type": { "type": "array", "items": { "type": "string", "enum": [ "Original", "Investigated" ] }, "x-nullable": true }, "source": { "type": "array", "items": { "type": "string" }, "x-nullable": true } }, "required": [ "severity", "type", "source" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v2", "Incident", "Incident Overview" ], "summary": "Returns the available filter params for this incident's events", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] }, { "JWT-Bearer": [] } ] } }, "/v2/incident/{incident-id}/verdicts": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "observable": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "end_time": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" }, {} ] } }, "required": [ "start_time", "end_time" ] }, "disposition": { "type": "integer", "format": "int64" }, "judgement_ids": { "type": "array", "items": { "type": "string", "format": "uuid", "x-anyOf": [ { "type": "string", "format": "uuid" }, { "type": "string" } ] }, "x-nullable": true }, "module": { "type": "string" }, "module_instance_id": { "type": "string", "format": "uuid", "x-anyOf": [ { "type": "string", "format": "uuid" }, { "type": "string" } ] }, "module_type_id": { "type": "string", "format": "uuid", "x-anyOf": [ { "type": "string", "format": "uuid" }, { "type": "string" } ] } }, "required": [ "type", "observable", "valid_time", "disposition", "judgement_ids", "module", "module_instance_id", "module_type_id" ] } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v2", "Incident", "Incident Overview" ], "summary": "Returns a list of events linked to this incident.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] }, { "JWT-Bearer": [] } ] } }, "/v2/incident/{incident-id}/graph": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "nodes": { "type": "object", "additionalProperties": { "type": "object", "properties": { "data": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "asset_id": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "indicators": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "internal": { "type": "boolean" }, "incoming-edges": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "value": { "type": "string" } }, "required": [ "id", "value" ] }, "uniqueItems": true }, "outgoing-edges": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "value": { "type": "string" } }, "required": [ "id", "value" ] }, "uniqueItems": true }, "investigated": { "type": "boolean" }, "is_asset": { "type": "boolean" }, "observableType": { "type": "string" }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" } }, "required": [ "type", "value", "disposition", "investigated" ] } }, "properties": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": {} }, "required": [ "name", "value" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": {} }, "required": [ "name", "value" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": {} }, "required": [ "name", "value" ] } } ] }, "modules": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "title": { "type": "string" }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." } }, "required": [ "type", "value", "indicators", "internal", "incoming-edges", "outgoing-edges", "investigated", "is_asset", "observableType", "observables", "modules", "sightings", "sources", "title" ] }, "times": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "integer", "format": "int64" } }, "required": [ "time" ] }, "uniqueItems": true } }, "required": [ "data", "times" ] } }, "edges": { "type": "object", "additionalProperties": { "type": "object", "properties": { "id1": { "type": "string" }, "id2": { "type": "string" }, "times": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "integer", "format": "int64" } }, "required": [ "time" ] }, "uniqueItems": true }, "data": { "type": "object", "properties": { "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "value": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "relation_info": {} }, "required": [ "value", "sightings" ] } }, "required": [ "id1", "id2", "times", "data" ] } }, "errors": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "E_DATA_TOO_LARGE" ] }, "message": { "type": "string" } }, "required": [ "type", "message" ] } } }, "required": [ "nodes", "edges" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v2", "Incident", "Incident Overview" ], "summary": "Returns a graph representation of this incident.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/{incident-id}/linked-casebooks": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": { "bundle": { "type": "object", "properties": { "id": { "type": "string" }, "description": { "type": "string" }, "attack_patterns": { "type": "array", "items": { "type": "object", "properties": {} } }, "assets": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_properties": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_mappings": { "type": "array", "items": { "type": "object", "properties": {} } }, "casebooks": { "type": "array", "items": { "type": "object", "properties": {} } }, "indicators": { "type": "array", "items": { "type": "object", "properties": {} } }, "judgements": { "type": "array", "items": { "type": "object", "properties": {} } }, "malwares": { "type": "array", "items": { "type": "object", "properties": {} } }, "modules": { "type": "array", "items": { "type": "object", "properties": {} } }, "relationships": { "type": "array", "items": { "type": "object", "properties": {} } }, "sightings": { "type": "array", "items": { "type": "object", "properties": {} } }, "verdicts": { "type": "array", "items": { "type": "object", "properties": {} } }, "tools": { "type": "array", "items": { "type": "object", "properties": {} } } } }, "texts": { "type": "array", "items": { "type": "object", "properties": { "text": { "type": "string" }, "type": { "type": "string" } }, "required": [ "text", "type" ] } }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "casebook" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "id", "groups", "schema_version", "type" ] } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v2", "Incident", "Incident Overview" ], "summary": "Return Linked Casebooks", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/{incident-id}/linked-incidents": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": { "assignees": { "type": "array", "items": { "type": "string" } }, "categories": { "type": "array", "items": { "type": "string", "enum": [ "Attrition", "Denial of Service", "Exercise", "Exercise/Network Defense Testing", "Explained Anomaly", "Forensics", "Improper Usage", "Intelligence", "Investigating", "Investigation", "Malicious Code", "Malicious Logic", "Non-Compliant", "Reconnaissance", "Root Level", "Scans/Probes/Attempted Access", "Unauthorized Access", "Unsuccessful", "User Level", "eDiscovery" ] } }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "detection_sources": { "type": "array", "items": { "type": "string" } }, "detection_status": { "title": "DetectionStatusType", "type": "string", "enum": [ "active", "inactive_merged", "inactive_expired", "inactive_oversized", "inactive_user_closed" ], "description": "Whether the incident is actively receiving detection data updates" }, "discovery_method": { "type": "string", "enum": [ "SecureX Threat Hunting", "Agent Disclosure", "Antivirus", "Audit", "Customer", "External - Fraud Detection", "Financial Audit", "HIPS", "IT Audit", "Incident Response", "Internal - Fraud Detection", "Law Enforcement", "Log Review", "Monitoring Service", "NIDS", "Security Alarm", "Unknown", "Unrelated Party", "User" ] }, "incident_time": { "type": "object", "properties": { "opened": { "type": "string" }, "closed": { "type": "string" }, "discovered": { "type": "string" }, "rejected": { "type": "string" }, "remediated": { "type": "string" }, "reported": { "type": "string" } }, "required": [ "opened" ] }, "intended_effect": { "type": "string", "enum": [ "Account Takeover", "Advantage", "Advantage - Economic", "Advantage - Military", "Advantage - Political", "Brand Damage", "Competitive Advantage", "Degradation of Service", "Denial and Deception", "Destruction", "Disruption", "Embarrassment", "Exposure", "Extortion", "Fraud", "Harassment", "ICS Control", "Theft", "Theft - Credential Theft", "Theft - Identity Theft", "Theft - Intellectual Property", "Theft - Theft of Proprietary Information", "Traffic Diversion", "Unauthorized Access" ] }, "meta": { "type": "object", "properties": { "ai_description": { "type": "boolean" }, "helios_report_generated": { "type": "boolean" } } }, "promotion_method": { "type": "string", "enum": [ "Automated", "Manual" ] }, "scores": { "type": "object", "properties": { "asset": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 10 }, "global": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 1000 }, "ml_score": { "type": "number", "format": "double" }, "ttp": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 100 } } }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_id": { "type": "string" }, "status": { "title": "IncidentStatusType", "type": "string", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ], "description": "The status of the incident" }, "tactics": { "type": "array", "items": { "type": "string" } }, "techniques": { "type": "array", "items": { "type": "string" } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "incident" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "confidence", "incident_time", "status", "id", "groups", "schema_version", "type" ] } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v2", "Incident", "Incident Overview" ], "summary": "Returns linked incidents", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/{incident-id}/primary-investigation": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "id": { "type": "string", "x-nullable": true }, "short_description": { "type": "string", "x-nullable": true }, "description": { "type": "string", "x-nullable": true }, "source": { "type": "string", "x-nullable": true } }, "required": [ "id", "short_description", "description", "source" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v2", "Incident", "Incident Overview" ], "summary": "Returns linked investigations", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/{incident-id}/errors": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": { "module_instance_id": { "type": "string", "format": "uuid" }, "module_type_id": { "type": "string", "format": "uuid" }, "module": { "type": "string", "x-nullable": true }, "type": { "type": "string", "enum": [ "fatal", "warning", "error" ] }, "code": { "type": "string" }, "message": { "type": "string" } }, "required": [ "module_instance_id", "module_type_id", "type", "code", "message" ] } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v2", "Incident", "Incident Overview" ], "summary": "Returns a list of errors reported by the attached investigations", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/{incident-id}/overview": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "created_at": { "type": "string", "format": "date-time" }, "description": { "type": "string", "x-nullable": true }, "short_description": { "type": "string", "x-nullable": true }, "saved": { "type": "boolean" }, "saved_at": { "type": "string", "format": "date-time", "x-nullable": true }, "investigated_observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "title": { "type": "string" }, "owner": { "type": "string" }, "short_id": { "type": "string", "x-nullable": true } }, "required": [ "id", "created_at", "description", "short_description", "saved", "saved_at", "investigated_observables", "title", "owner" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v2", "Incident", "Incident Overview" ], "summary": "Returns baseline incident information", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/{incident-id}/recommend": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "phases": { "type": "array", "items": { "title": "Phase", "type": "object", "properties": { "phase_id": { "type": "string" }, "phase_title": { "type": "string" }, "status": { "title": "Phase.Status", "description": "The Current status of the `phase`", "type": "string", "enum": [ "available", "completed" ], "default": "available" }, "action_total_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The total number of `tasks` in this phase.", "example": 7 }, "action_counts": { "type": "object", "properties": { "available": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The number of available `tasks` in a given `phase`.", "example": 1 }, "running": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The number of running `tasks` in a given `phase`.", "example": 0 }, "not-applicable": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The number of not-applicable `tasks` in a given `phase`.", "example": 1 }, "completed": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The number of completed `tasks` in a given `phase`.", "example": 1 }, "failed": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The number of failed `tasks` in a given `phase`.", "example": 1 }, "action-required": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The number of action-required `tasks` in a given `phase`.", "example": 1 }, "partially-completed": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The number of partially-completed `tasks` in a given `phase`.", "example": 1 }, "errored": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The number of errored `tasks` in a given `phase`.", "example": 1 } }, "required": [ "available", "running", "not-applicable", "completed", "failed", "action-required", "partially-completed", "errored" ] } }, "required": [ "phase_id", "phase_title", "status", "action_total_count", "action_counts" ], "description": "The `phase` summary objects" } }, "incident": { "type": "object", "properties": { "assignees": { "type": "array", "items": { "type": "string" } }, "categories": { "type": "array", "items": { "type": "string", "enum": [ "Attrition", "Denial of Service", "Exercise", "Exercise/Network Defense Testing", "Explained Anomaly", "Forensics", "Improper Usage", "Intelligence", "Investigating", "Investigation", "Malicious Code", "Malicious Logic", "Non-Compliant", "Reconnaissance", "Root Level", "Scans/Probes/Attempted Access", "Unauthorized Access", "Unsuccessful", "User Level", "eDiscovery" ] } }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "detection_sources": { "type": "array", "items": { "type": "string" } }, "detection_status": { "title": "DetectionStatusType", "type": "string", "enum": [ "active", "inactive_merged", "inactive_expired", "inactive_oversized", "inactive_user_closed" ], "description": "Whether the incident is actively receiving detection data updates" }, "discovery_method": { "type": "string", "enum": [ "SecureX Threat Hunting", "Agent Disclosure", "Antivirus", "Audit", "Customer", "External - Fraud Detection", "Financial Audit", "HIPS", "IT Audit", "Incident Response", "Internal - Fraud Detection", "Law Enforcement", "Log Review", "Monitoring Service", "NIDS", "Security Alarm", "Unknown", "Unrelated Party", "User" ] }, "incident_time": { "type": "object", "properties": { "opened": { "type": "string" }, "closed": { "type": "string" }, "discovered": { "type": "string" }, "rejected": { "type": "string" }, "remediated": { "type": "string" }, "reported": { "type": "string" } }, "required": [ "opened" ] }, "intended_effect": { "type": "string", "enum": [ "Account Takeover", "Advantage", "Advantage - Economic", "Advantage - Military", "Advantage - Political", "Brand Damage", "Competitive Advantage", "Degradation of Service", "Denial and Deception", "Destruction", "Disruption", "Embarrassment", "Exposure", "Extortion", "Fraud", "Harassment", "ICS Control", "Theft", "Theft - Credential Theft", "Theft - Identity Theft", "Theft - Intellectual Property", "Theft - Theft of Proprietary Information", "Traffic Diversion", "Unauthorized Access" ] }, "meta": { "type": "object", "properties": { "ai_description": { "type": "boolean" }, "helios_report_generated": { "type": "boolean" } } }, "promotion_method": { "type": "string", "enum": [ "Automated", "Manual" ] }, "scores": { "type": "object", "properties": { "asset": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 10 }, "global": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 1000 }, "ml_score": { "type": "number", "format": "double" }, "ttp": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 100 } } }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_id": { "type": "string" }, "status": { "title": "IncidentStatusType", "type": "string", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ], "description": "The status of the incident" }, "tactics": { "type": "array", "items": { "type": "string" } }, "techniques": { "type": "array", "items": { "type": "string" } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "incident" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "confidence", "incident_time", "status", "id", "groups", "schema_version", "type" ] }, "incident_id": { "type": "string", "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" }, "partially_completed_actions": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "Action.Type", "description": "The type of action this describes", "type": "string", "enum": [ "task", "ui", "continue" ], "default": "task" }, "action": { "title": "Action.Item", "description": "The subset of actions items that are available depending on the action type.", "type": "string", "enum": [ "execute", "ui_select", "continue", "redirect", "dispatch" ], "default": "execute" }, "note_draft": { "type": "object", "properties": { "ai_generated": { "title": "NoteDraft.AIGenerated", "description": "The ai generated flag indicates if this was processed through AI or not.", "type": "boolean", "default": true }, "content": { "title": "NoteDraftContent", "description": "A string between 1 and 2500 characters representing the markdown content.", "type": "string", "minLength": 1, "maxLength": 2500, "x-nullable": true, "default": "## Created Note for Task\n\nExpected Note Content" }, "created_at": { "title": "NoteDraft.Created_At", "description": "When the note draft was requested.", "type": "string", "format": "date-time", "example": "2026-08-18T22:03:31.927586580Z" }, "updated_at": { "title": "NoteDraft.Updated_At", "description": "When the note draft content was updated.", "type": "string", "format": "date-time", "x-nullable": true, "example": null }, "error": { "title": "NoteDraftContent", "description": "A string between 1 and 2500 characters representing the markdown content.", "type": "string", "minLength": 1, "maxLength": 2500, "x-nullable": true, "default": "Unable to Process Request" }, "failed": { "title": "NoteDraft.Failed", "description": "If the note draft request failed.", "type": "boolean", "default": false }, "generating": { "title": "NoteDraft.Generating", "description": "Returns true if the note is actively being generated.", "type": "boolean", "default": false }, "user_id": { "title": "NoteDraft.User_ID", "description": "The user who initiated the note draft request", "type": "string", "default": "example-user-1" }, "task_id": { "title": "NoteDraft.Task_ID", "description": "The ID of the `task` that the note draft was requested for.", "type": "uuid", "default": "2105151b-aeba-41c8-807c-9042a162c949" } }, "required": [ "ai_generated", "content", "created_at", "updated_at", "error", "failed", "generating", "user_id", "task_id" ], "x-nullable": true }, "id": { "type": "string" }, "is_global": { "type": "boolean" }, "task_id": { "type": "string" }, "phase_id": { "type": "string" }, "phase_title": { "type": "string", "description": "Title of the phase, this will only be present if this is type `task`. It will map to the `stage` of the given Phase.", "example": "Identification" }, "description": { "type": "string", "description": "Description of the action, if this is type `task` it will map to the underlying task description.", "example": "Upon analysis, change the incident status to match one of the following definitions:\n- Open - The incident is suspicious, escalated, or requires additional investigation or data for disposition.\n- Rejected - The incident is a false positive and considered an authorized exception.\n- Incident Reported - The incident is confirmed as being malicious, improper usage, or unauthorized activity that violates company policy.\n- Stalled - Data has been requested or the investigation cannot continue due to missing data or lack of clarity.\n\nAfter documenting and notifying, you should move to the containment phase." }, "short_description": { "type": "string", "description": "Short description of the action, if this is type `task` it will map to the underlying task short description.", "example": "Upon analysis, change the incident status to match one of the following definitions:\n- Open - The incident is suspicious, escalated, or requires additional investigation or data for disposition.\n- Rejected - The incident is a false positive and considered an authorized exception.\n- Incident Reported - The incident is confirmed as being malicious, improper usage, or unauthorized activity that violates company policy.\n- Stalled - Data has been requested or the investigation cannot continue due to missing data or lack of clarity.\n\nAfter documenting and notifying, you should move to the containment phase." }, "title": { "type": "string", "description": "Title of the action.", "example": "Confirm Incident" }, "select": { "type": "array", "items": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the reported type, value Observable.", "x-anyOf": [ { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the reported type, value Observable." }, { "type": "string" } ] }, "description": "The selectable target types to display.", "example": [ "amp_computer_guid" ] }, "url": { "type": "string" } }, "required": [ "type", "action", "id", "description", "short_description", "title" ] } }, "available_actions": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "Action.Type", "description": "The type of action this describes", "type": "string", "enum": [ "task", "ui", "continue" ], "default": "task" }, "action": { "title": "Action.Item", "description": "The subset of actions items that are available depending on the action type.", "type": "string", "enum": [ "execute", "ui_select", "continue", "redirect", "dispatch" ], "default": "execute" }, "note_draft": { "type": "object", "properties": { "ai_generated": { "title": "NoteDraft.AIGenerated", "description": "The ai generated flag indicates if this was processed through AI or not.", "type": "boolean", "default": true }, "content": { "title": "NoteDraftContent", "description": "A string between 1 and 2500 characters representing the markdown content.", "type": "string", "minLength": 1, "maxLength": 2500, "x-nullable": true, "default": "## Created Note for Task\n\nExpected Note Content" }, "created_at": { "title": "NoteDraft.Created_At", "description": "When the note draft was requested.", "type": "string", "format": "date-time", "example": "2026-08-18T22:03:31.927586580Z" }, "updated_at": { "title": "NoteDraft.Updated_At", "description": "When the note draft content was updated.", "type": "string", "format": "date-time", "x-nullable": true, "example": null }, "error": { "title": "NoteDraftContent", "description": "A string between 1 and 2500 characters representing the markdown content.", "type": "string", "minLength": 1, "maxLength": 2500, "x-nullable": true, "default": "Unable to Process Request" }, "failed": { "title": "NoteDraft.Failed", "description": "If the note draft request failed.", "type": "boolean", "default": false }, "generating": { "title": "NoteDraft.Generating", "description": "Returns true if the note is actively being generated.", "type": "boolean", "default": false }, "user_id": { "title": "NoteDraft.User_ID", "description": "The user who initiated the note draft request", "type": "string", "default": "example-user-1" }, "task_id": { "title": "NoteDraft.Task_ID", "description": "The ID of the `task` that the note draft was requested for.", "type": "uuid", "default": "2105151b-aeba-41c8-807c-9042a162c949" } }, "required": [ "ai_generated", "content", "created_at", "updated_at", "error", "failed", "generating", "user_id", "task_id" ], "x-nullable": true }, "id": { "type": "string" }, "is_global": { "type": "boolean" }, "task_id": { "type": "string" }, "phase_id": { "type": "string" }, "phase_title": { "type": "string", "description": "Title of the phase, this will only be present if this is type `task`. It will map to the `stage` of the given Phase.", "example": "Identification" }, "description": { "type": "string", "description": "Description of the action, if this is type `task` it will map to the underlying task description.", "example": "Upon analysis, change the incident status to match one of the following definitions:\n- Open - The incident is suspicious, escalated, or requires additional investigation or data for disposition.\n- Rejected - The incident is a false positive and considered an authorized exception.\n- Incident Reported - The incident is confirmed as being malicious, improper usage, or unauthorized activity that violates company policy.\n- Stalled - Data has been requested or the investigation cannot continue due to missing data or lack of clarity.\n\nAfter documenting and notifying, you should move to the containment phase." }, "short_description": { "type": "string", "description": "Short description of the action, if this is type `task` it will map to the underlying task short description.", "example": "Upon analysis, change the incident status to match one of the following definitions:\n- Open - The incident is suspicious, escalated, or requires additional investigation or data for disposition.\n- Rejected - The incident is a false positive and considered an authorized exception.\n- Incident Reported - The incident is confirmed as being malicious, improper usage, or unauthorized activity that violates company policy.\n- Stalled - Data has been requested or the investigation cannot continue due to missing data or lack of clarity.\n\nAfter documenting and notifying, you should move to the containment phase." }, "title": { "type": "string", "description": "Title of the action.", "example": "Confirm Incident" }, "select": { "type": "array", "items": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the reported type, value Observable.", "x-anyOf": [ { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the reported type, value Observable." }, { "type": "string" } ] }, "description": "The selectable target types to display.", "example": [ "amp_computer_guid" ] }, "url": { "type": "string" } }, "required": [ "type", "action", "id", "description", "short_description", "title" ] } }, "completed_actions": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "Action.Type", "description": "The type of action this describes", "type": "string", "enum": [ "task", "ui", "continue" ], "default": "task" }, "action": { "title": "Action.Item", "description": "The subset of actions items that are available depending on the action type.", "type": "string", "enum": [ "execute", "ui_select", "continue", "redirect", "dispatch" ], "default": "execute" }, "note_draft": { "type": "object", "properties": { "ai_generated": { "title": "NoteDraft.AIGenerated", "description": "The ai generated flag indicates if this was processed through AI or not.", "type": "boolean", "default": true }, "content": { "title": "NoteDraftContent", "description": "A string between 1 and 2500 characters representing the markdown content.", "type": "string", "minLength": 1, "maxLength": 2500, "x-nullable": true, "default": "## Created Note for Task\n\nExpected Note Content" }, "created_at": { "title": "NoteDraft.Created_At", "description": "When the note draft was requested.", "type": "string", "format": "date-time", "example": "2026-08-18T22:03:31.927586580Z" }, "updated_at": { "title": "NoteDraft.Updated_At", "description": "When the note draft content was updated.", "type": "string", "format": "date-time", "x-nullable": true, "example": null }, "error": { "title": "NoteDraftContent", "description": "A string between 1 and 2500 characters representing the markdown content.", "type": "string", "minLength": 1, "maxLength": 2500, "x-nullable": true, "default": "Unable to Process Request" }, "failed": { "title": "NoteDraft.Failed", "description": "If the note draft request failed.", "type": "boolean", "default": false }, "generating": { "title": "NoteDraft.Generating", "description": "Returns true if the note is actively being generated.", "type": "boolean", "default": false }, "user_id": { "title": "NoteDraft.User_ID", "description": "The user who initiated the note draft request", "type": "string", "default": "example-user-1" }, "task_id": { "title": "NoteDraft.Task_ID", "description": "The ID of the `task` that the note draft was requested for.", "type": "uuid", "default": "2105151b-aeba-41c8-807c-9042a162c949" } }, "required": [ "ai_generated", "content", "created_at", "updated_at", "error", "failed", "generating", "user_id", "task_id" ], "x-nullable": true }, "id": { "type": "string" }, "is_global": { "type": "boolean" }, "task_id": { "type": "string" }, "phase_id": { "type": "string" }, "phase_title": { "type": "string", "description": "Title of the phase, this will only be present if this is type `task`. It will map to the `stage` of the given Phase.", "example": "Identification" }, "description": { "type": "string", "description": "Description of the action, if this is type `task` it will map to the underlying task description.", "example": "Upon analysis, change the incident status to match one of the following definitions:\n- Open - The incident is suspicious, escalated, or requires additional investigation or data for disposition.\n- Rejected - The incident is a false positive and considered an authorized exception.\n- Incident Reported - The incident is confirmed as being malicious, improper usage, or unauthorized activity that violates company policy.\n- Stalled - Data has been requested or the investigation cannot continue due to missing data or lack of clarity.\n\nAfter documenting and notifying, you should move to the containment phase." }, "short_description": { "type": "string", "description": "Short description of the action, if this is type `task` it will map to the underlying task short description.", "example": "Upon analysis, change the incident status to match one of the following definitions:\n- Open - The incident is suspicious, escalated, or requires additional investigation or data for disposition.\n- Rejected - The incident is a false positive and considered an authorized exception.\n- Incident Reported - The incident is confirmed as being malicious, improper usage, or unauthorized activity that violates company policy.\n- Stalled - Data has been requested or the investigation cannot continue due to missing data or lack of clarity.\n\nAfter documenting and notifying, you should move to the containment phase." }, "title": { "type": "string", "description": "Title of the action.", "example": "Confirm Incident" }, "select": { "type": "array", "items": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the reported type, value Observable.", "x-anyOf": [ { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the reported type, value Observable." }, { "type": "string" } ] }, "description": "The selectable target types to display.", "example": [ "amp_computer_guid" ] }, "url": { "type": "string" } }, "required": [ "type", "action", "id", "description", "short_description", "title" ] } }, "running_actions": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "Action.Type", "description": "The type of action this describes", "type": "string", "enum": [ "task", "ui", "continue" ], "default": "task" }, "action": { "title": "Action.Item", "description": "The subset of actions items that are available depending on the action type.", "type": "string", "enum": [ "execute", "ui_select", "continue", "redirect", "dispatch" ], "default": "execute" }, "note_draft": { "type": "object", "properties": { "ai_generated": { "title": "NoteDraft.AIGenerated", "description": "The ai generated flag indicates if this was processed through AI or not.", "type": "boolean", "default": true }, "content": { "title": "NoteDraftContent", "description": "A string between 1 and 2500 characters representing the markdown content.", "type": "string", "minLength": 1, "maxLength": 2500, "x-nullable": true, "default": "## Created Note for Task\n\nExpected Note Content" }, "created_at": { "title": "NoteDraft.Created_At", "description": "When the note draft was requested.", "type": "string", "format": "date-time", "example": "2026-08-18T22:03:31.927586580Z" }, "updated_at": { "title": "NoteDraft.Updated_At", "description": "When the note draft content was updated.", "type": "string", "format": "date-time", "x-nullable": true, "example": null }, "error": { "title": "NoteDraftContent", "description": "A string between 1 and 2500 characters representing the markdown content.", "type": "string", "minLength": 1, "maxLength": 2500, "x-nullable": true, "default": "Unable to Process Request" }, "failed": { "title": "NoteDraft.Failed", "description": "If the note draft request failed.", "type": "boolean", "default": false }, "generating": { "title": "NoteDraft.Generating", "description": "Returns true if the note is actively being generated.", "type": "boolean", "default": false }, "user_id": { "title": "NoteDraft.User_ID", "description": "The user who initiated the note draft request", "type": "string", "default": "example-user-1" }, "task_id": { "title": "NoteDraft.Task_ID", "description": "The ID of the `task` that the note draft was requested for.", "type": "uuid", "default": "2105151b-aeba-41c8-807c-9042a162c949" } }, "required": [ "ai_generated", "content", "created_at", "updated_at", "error", "failed", "generating", "user_id", "task_id" ], "x-nullable": true }, "id": { "type": "string" }, "is_global": { "type": "boolean" }, "task_id": { "type": "string" }, "phase_id": { "type": "string" }, "phase_title": { "type": "string", "description": "Title of the phase, this will only be present if this is type `task`. It will map to the `stage` of the given Phase.", "example": "Identification" }, "description": { "type": "string", "description": "Description of the action, if this is type `task` it will map to the underlying task description.", "example": "Upon analysis, change the incident status to match one of the following definitions:\n- Open - The incident is suspicious, escalated, or requires additional investigation or data for disposition.\n- Rejected - The incident is a false positive and considered an authorized exception.\n- Incident Reported - The incident is confirmed as being malicious, improper usage, or unauthorized activity that violates company policy.\n- Stalled - Data has been requested or the investigation cannot continue due to missing data or lack of clarity.\n\nAfter documenting and notifying, you should move to the containment phase." }, "short_description": { "type": "string", "description": "Short description of the action, if this is type `task` it will map to the underlying task short description.", "example": "Upon analysis, change the incident status to match one of the following definitions:\n- Open - The incident is suspicious, escalated, or requires additional investigation or data for disposition.\n- Rejected - The incident is a false positive and considered an authorized exception.\n- Incident Reported - The incident is confirmed as being malicious, improper usage, or unauthorized activity that violates company policy.\n- Stalled - Data has been requested or the investigation cannot continue due to missing data or lack of clarity.\n\nAfter documenting and notifying, you should move to the containment phase." }, "title": { "type": "string", "description": "Title of the action.", "example": "Confirm Incident" }, "select": { "type": "array", "items": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the reported type, value Observable.", "x-anyOf": [ { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the reported type, value Observable." }, { "type": "string" } ] }, "description": "The selectable target types to display.", "example": [ "amp_computer_guid" ] }, "url": { "type": "string" } }, "required": [ "type", "action", "id", "description", "short_description", "title" ] } }, "errored_actions": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "Action.Type", "description": "The type of action this describes", "type": "string", "enum": [ "task", "ui", "continue" ], "default": "task" }, "action": { "title": "Action.Item", "description": "The subset of actions items that are available depending on the action type.", "type": "string", "enum": [ "execute", "ui_select", "continue", "redirect", "dispatch" ], "default": "execute" }, "note_draft": { "type": "object", "properties": { "ai_generated": { "title": "NoteDraft.AIGenerated", "description": "The ai generated flag indicates if this was processed through AI or not.", "type": "boolean", "default": true }, "content": { "title": "NoteDraftContent", "description": "A string between 1 and 2500 characters representing the markdown content.", "type": "string", "minLength": 1, "maxLength": 2500, "x-nullable": true, "default": "## Created Note for Task\n\nExpected Note Content" }, "created_at": { "title": "NoteDraft.Created_At", "description": "When the note draft was requested.", "type": "string", "format": "date-time", "example": "2026-08-18T22:03:31.927586580Z" }, "updated_at": { "title": "NoteDraft.Updated_At", "description": "When the note draft content was updated.", "type": "string", "format": "date-time", "x-nullable": true, "example": null }, "error": { "title": "NoteDraftContent", "description": "A string between 1 and 2500 characters representing the markdown content.", "type": "string", "minLength": 1, "maxLength": 2500, "x-nullable": true, "default": "Unable to Process Request" }, "failed": { "title": "NoteDraft.Failed", "description": "If the note draft request failed.", "type": "boolean", "default": false }, "generating": { "title": "NoteDraft.Generating", "description": "Returns true if the note is actively being generated.", "type": "boolean", "default": false }, "user_id": { "title": "NoteDraft.User_ID", "description": "The user who initiated the note draft request", "type": "string", "default": "example-user-1" }, "task_id": { "title": "NoteDraft.Task_ID", "description": "The ID of the `task` that the note draft was requested for.", "type": "uuid", "default": "2105151b-aeba-41c8-807c-9042a162c949" } }, "required": [ "ai_generated", "content", "created_at", "updated_at", "error", "failed", "generating", "user_id", "task_id" ], "x-nullable": true }, "id": { "type": "string" }, "is_global": { "type": "boolean" }, "task_id": { "type": "string" }, "phase_id": { "type": "string" }, "phase_title": { "type": "string", "description": "Title of the phase, this will only be present if this is type `task`. It will map to the `stage` of the given Phase.", "example": "Identification" }, "description": { "type": "string", "description": "Description of the action, if this is type `task` it will map to the underlying task description.", "example": "Upon analysis, change the incident status to match one of the following definitions:\n- Open - The incident is suspicious, escalated, or requires additional investigation or data for disposition.\n- Rejected - The incident is a false positive and considered an authorized exception.\n- Incident Reported - The incident is confirmed as being malicious, improper usage, or unauthorized activity that violates company policy.\n- Stalled - Data has been requested or the investigation cannot continue due to missing data or lack of clarity.\n\nAfter documenting and notifying, you should move to the containment phase." }, "short_description": { "type": "string", "description": "Short description of the action, if this is type `task` it will map to the underlying task short description.", "example": "Upon analysis, change the incident status to match one of the following definitions:\n- Open - The incident is suspicious, escalated, or requires additional investigation or data for disposition.\n- Rejected - The incident is a false positive and considered an authorized exception.\n- Incident Reported - The incident is confirmed as being malicious, improper usage, or unauthorized activity that violates company policy.\n- Stalled - Data has been requested or the investigation cannot continue due to missing data or lack of clarity.\n\nAfter documenting and notifying, you should move to the containment phase." }, "title": { "type": "string", "description": "Title of the action.", "example": "Confirm Incident" }, "select": { "type": "array", "items": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the reported type, value Observable.", "x-anyOf": [ { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the reported type, value Observable." }, { "type": "string" } ] }, "description": "The selectable target types to display.", "example": [ "amp_computer_guid" ] }, "url": { "type": "string" } }, "required": [ "type", "action", "id", "description", "short_description", "title" ] } } }, "required": [ "phases", "incident", "incident_id", "partially_completed_actions", "available_actions", "completed_actions", "running_actions", "errored_actions" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v2", "Incident" ], "summary": "Recommend actions for an incident.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/{incident-id}/export": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "incident_id": { "type": "string" }, "short_id": { "type": "string", "x-nullable": true }, "incident_summary": { "type": "object", "properties": { "endpoint_url": { "type": "string" }, "data": { "type": "object", "properties": { "event_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "last_seen_event": { "type": "string", "format": "date-time", "x-nullable": true }, "first_seen_event": { "type": "string", "format": "date-time", "x-nullable": true }, "sources": { "type": "array", "items": { "type": "string" } }, "indicators": { "type": "object", "properties": { "total_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "producer": { "type": "string" }, "description": { "type": "string", "x-nullable": true }, "short_description": { "type": "string", "x-nullable": true }, "internal": { "type": "boolean" }, "source": { "type": "string", "x-nullable": true }, "source_uri": { "type": "string", "x-nullable": true }, "sources": { "type": "array", "items": { "type": "string" } }, "tags": { "type": "array", "items": { "type": "string" }, "x-nullable": true }, "title": { "type": "string", "x-nullable": true }, "value": { "type": "string" }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "id", "producer", "description", "short_description", "internal", "source", "source_uri", "sources", "tags", "title", "value", "count" ] } } }, "required": [ "total_count", "data" ] }, "observables": { "type": "object", "properties": { "total_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated", "count" ] } } }, "required": [ "total_count", "data" ] }, "targets": { "type": "object", "properties": { "total_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "type": { "title": "TargetTypeEnum", "type": "string", "enum": [ "device", "person", "user", "email", "endpoint.sensor", "process.network-scanner", "network.switch", "network.security_manager", "process.vulnerability-scanner", "network.hub", "network.ids", "network.firewall", "process", "network.sense_making", "process.sandbox", "network.modem", "process.email-service", "process.dns-server", "network.vpn", "process.connection-scanner", "network.nic", "endpoint.printer", "network.gateway", "process.reputation-service", "process.remediation-service", "network", "process.virtualization-service", "network.ips", "endpoint.smart-meter", "endpoint.digital-telephone-handset", "endpoint.workstation", "endpoint.server", "network.wap", "endpoint.laptop", "process.aaa-server", "process.directory-service", "endpoint.pos-terminal", "network.bridge", "process.file-scanner", "network.proxy", "endpoint", "process.location-service", "network.sensor", "endpoint.smart-phone", "network.hips", "process.anti-virus-scanner", "endpoint.tablet", "network.guard", "network.router" ], "example": "endpoint", "description": "The targe type/actuator that best fits the device." }, "value": { "title": "TargetSummary.Value", "type": "string", "example": "CARGO-Example", "description": "The targe type/actuator that best fits the device." }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The numerical value of the Device. Will Default to 10 if the Target is resolved.", "example": 2, "x-nullable": true, "default": 7 }, "is_asset": { "title": "TargetSummary.IsAssetEnum", "enum": [ true ], "type": "boolean", "example": true, "description": "Always true for targets." }, "observableType": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The observable type of the defining target observable" }, "observables": { "title": "TargetSummary.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true, "description": "The observable type of the defining target observable" }, "asset_id": { "title": "TargetSummary.AssetId", "type": "string", "example": "4911bbf5-aa42-463b-9a47-65f24140cfe4", "description": "The Device/User Insights ID of this Person or Device.", "x-nullable": true }, "properties": { "title": "TargetSummary.Properties", "type": "array", "items": { "type": "object", "properties": { "name": { "title": "Property.Name", "type": "string", "description": "An open vocabulary string that describes the name of the property.", "example": "cisco:ctr:labels" }, "value": { "title": "Property.Value", "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": {} } ], "description": "The value of the named property.", "example": [ "example label", 1, [ "it can be a string or an int or a vector of anything" ] ] } }, "required": [ "name", "value" ] }, "uniqueItems": true, "description": "The List of Device or Person properties for this resolved Person/Device." }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "type", "value", "is_asset", "observableType", "observables", "asset_id", "properties", "count" ] } } }, "required": [ "total_count", "data" ] }, "casebooks": { "type": "array", "items": { "type": "object", "properties": { "bundle": { "type": "object", "properties": { "id": { "type": "string" }, "description": { "type": "string" }, "attack_patterns": { "type": "array", "items": { "type": "object", "properties": {} } }, "assets": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_properties": { "type": "array", "items": { "type": "object", "properties": {} } }, "asset_mappings": { "type": "array", "items": { "type": "object", "properties": {} } }, "casebooks": { "type": "array", "items": { "type": "object", "properties": {} } }, "indicators": { "type": "array", "items": { "type": "object", "properties": {} } }, "judgements": { "type": "array", "items": { "type": "object", "properties": {} } }, "malwares": { "type": "array", "items": { "type": "object", "properties": {} } }, "modules": { "type": "array", "items": { "type": "object", "properties": {} } }, "relationships": { "type": "array", "items": { "type": "object", "properties": {} } }, "sightings": { "type": "array", "items": { "type": "object", "properties": {} } }, "verdicts": { "type": "array", "items": { "type": "object", "properties": {} } }, "tools": { "type": "array", "items": { "type": "object", "properties": {} } } } }, "texts": { "type": "array", "items": { "type": "object", "properties": { "text": { "type": "string" }, "type": { "type": "string" } }, "required": [ "text", "type" ] } }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "casebook" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "id", "groups", "schema_version", "type" ] } }, "incident": { "type": "object", "properties": { "assignees": { "type": "array", "items": { "type": "string" } }, "categories": { "type": "array", "items": { "type": "string", "enum": [ "Attrition", "Denial of Service", "Exercise", "Exercise/Network Defense Testing", "Explained Anomaly", "Forensics", "Improper Usage", "Intelligence", "Investigating", "Investigation", "Malicious Code", "Malicious Logic", "Non-Compliant", "Reconnaissance", "Root Level", "Scans/Probes/Attempted Access", "Unauthorized Access", "Unsuccessful", "User Level", "eDiscovery" ] } }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "detection_sources": { "type": "array", "items": { "type": "string" } }, "detection_status": { "title": "DetectionStatusType", "type": "string", "enum": [ "active", "inactive_merged", "inactive_expired", "inactive_oversized", "inactive_user_closed" ], "description": "Whether the incident is actively receiving detection data updates" }, "discovery_method": { "type": "string", "enum": [ "SecureX Threat Hunting", "Agent Disclosure", "Antivirus", "Audit", "Customer", "External - Fraud Detection", "Financial Audit", "HIPS", "IT Audit", "Incident Response", "Internal - Fraud Detection", "Law Enforcement", "Log Review", "Monitoring Service", "NIDS", "Security Alarm", "Unknown", "Unrelated Party", "User" ] }, "incident_time": { "type": "object", "properties": { "opened": { "type": "string" }, "closed": { "type": "string" }, "discovered": { "type": "string" }, "rejected": { "type": "string" }, "remediated": { "type": "string" }, "reported": { "type": "string" } }, "required": [ "opened" ] }, "intended_effect": { "type": "string", "enum": [ "Account Takeover", "Advantage", "Advantage - Economic", "Advantage - Military", "Advantage - Political", "Brand Damage", "Competitive Advantage", "Degradation of Service", "Denial and Deception", "Destruction", "Disruption", "Embarrassment", "Exposure", "Extortion", "Fraud", "Harassment", "ICS Control", "Theft", "Theft - Credential Theft", "Theft - Identity Theft", "Theft - Intellectual Property", "Theft - Theft of Proprietary Information", "Traffic Diversion", "Unauthorized Access" ] }, "meta": { "type": "object", "properties": { "ai_description": { "type": "boolean" }, "helios_report_generated": { "type": "boolean" } } }, "promotion_method": { "type": "string", "enum": [ "Automated", "Manual" ] }, "scores": { "type": "object", "properties": { "asset": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 10 }, "global": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 1000 }, "ml_score": { "type": "number", "format": "double" }, "ttp": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 100 } } }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_id": { "type": "string" }, "status": { "title": "IncidentStatusType", "type": "string", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ], "description": "The status of the incident" }, "tactics": { "type": "array", "items": { "type": "string" } }, "techniques": { "type": "array", "items": { "type": "string" } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "incident" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "confidence", "incident_time", "status", "id", "groups", "schema_version", "type" ] }, "linked_incidents": { "type": "array", "items": { "type": "object", "properties": { "assignees": { "type": "array", "items": { "type": "string" } }, "categories": { "type": "array", "items": { "type": "string", "enum": [ "Attrition", "Denial of Service", "Exercise", "Exercise/Network Defense Testing", "Explained Anomaly", "Forensics", "Improper Usage", "Intelligence", "Investigating", "Investigation", "Malicious Code", "Malicious Logic", "Non-Compliant", "Reconnaissance", "Root Level", "Scans/Probes/Attempted Access", "Unauthorized Access", "Unsuccessful", "User Level", "eDiscovery" ] } }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "detection_sources": { "type": "array", "items": { "type": "string" } }, "detection_status": { "title": "DetectionStatusType", "type": "string", "enum": [ "active", "inactive_merged", "inactive_expired", "inactive_oversized", "inactive_user_closed" ], "description": "Whether the incident is actively receiving detection data updates" }, "discovery_method": { "type": "string", "enum": [ "SecureX Threat Hunting", "Agent Disclosure", "Antivirus", "Audit", "Customer", "External - Fraud Detection", "Financial Audit", "HIPS", "IT Audit", "Incident Response", "Internal - Fraud Detection", "Law Enforcement", "Log Review", "Monitoring Service", "NIDS", "Security Alarm", "Unknown", "Unrelated Party", "User" ] }, "incident_time": { "type": "object", "properties": { "opened": { "type": "string" }, "closed": { "type": "string" }, "discovered": { "type": "string" }, "rejected": { "type": "string" }, "remediated": { "type": "string" }, "reported": { "type": "string" } }, "required": [ "opened" ] }, "intended_effect": { "type": "string", "enum": [ "Account Takeover", "Advantage", "Advantage - Economic", "Advantage - Military", "Advantage - Political", "Brand Damage", "Competitive Advantage", "Degradation of Service", "Denial and Deception", "Destruction", "Disruption", "Embarrassment", "Exposure", "Extortion", "Fraud", "Harassment", "ICS Control", "Theft", "Theft - Credential Theft", "Theft - Identity Theft", "Theft - Intellectual Property", "Theft - Theft of Proprietary Information", "Traffic Diversion", "Unauthorized Access" ] }, "meta": { "type": "object", "properties": { "ai_description": { "type": "boolean" }, "helios_report_generated": { "type": "boolean" } } }, "promotion_method": { "type": "string", "enum": [ "Automated", "Manual" ] }, "scores": { "type": "object", "properties": { "asset": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 10 }, "global": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 1000 }, "ml_score": { "type": "number", "format": "double" }, "ttp": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 100 } } }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_id": { "type": "string" }, "status": { "title": "IncidentStatusType", "type": "string", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ], "description": "The status of the incident" }, "tactics": { "type": "array", "items": { "type": "string" } }, "techniques": { "type": "array", "items": { "type": "string" } }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "id": { "type": "string" }, "client_id": { "type": "string" }, "modified": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "created": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] }, "owner": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "boolean" } ], "x-nullable": true }, "groups": { "type": "array", "items": { "type": "string" } }, "schema_version": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "type": { "type": "string", "enum": [ "incident" ] }, "timestamp": { "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ] } }, "required": [ "confidence", "incident_time", "status", "id", "groups", "schema_version", "type" ] } }, "investigations": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "x-nullable": true }, "short_description": { "type": "string", "x-nullable": true }, "description": { "type": "string", "x-nullable": true }, "source": { "type": "string", "x-nullable": true } }, "required": [ "id", "short_description", "description", "source" ] } }, "linked_references": { "type": "object", "properties": { "investigation_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "incident_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "indicator_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "casebook_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "total": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "investigation_count", "incident_count", "indicator_count", "casebook_count", "total" ] }, "primary_investigation": { "type": "object", "properties": { "id": { "type": "string", "x-nullable": true }, "short_description": { "type": "string", "x-nullable": true }, "description": { "type": "string", "x-nullable": true }, "source": { "type": "string", "x-nullable": true } }, "required": [ "id", "short_description", "description", "source" ] }, "mitre_data": { "type": "object", "properties": { "total_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "enum": [ "TA0004", "TA0010", "TA0005", "TA0001", "TA0009", "TA0002", "TA0040", "TA0043", "TA0011", "TA0008", "TA0042", "TA0006", "TA0007", "TA0003" ] }, "value": { "type": "string", "enum": [ "TA0004", "TA0010", "TA0005", "TA0001", "TA0009", "TA0002", "TA0040", "TA0043", "TA0011", "TA0008", "TA0042", "TA0006", "TA0007", "TA0003" ] }, "phase_name": { "type": "string", "enum": [ "privilege-escalation", "exfiltration", "defense-evasion", "initial-access", "collection", "execution", "impact", "reconnaissance", "command-and-control", "lateral-movement", "resource-development", "credential-access", "discovery", "persistence" ] }, "priority": { "type": "integer", "enum": [ 6, 12, 7, 3, 10, 4, 13, 1, 11, 9, 2, 8, 8, 5 ] }, "url": { "type": "string", "enum": [ "https://attack.mitre.org/tactics/TA0004/", "https://attack.mitre.org/tactics/TA0010/", "https://attack.mitre.org/tactics/TA0005/", "https://attack.mitre.org/tactics/TA0001/", "https://attack.mitre.org/tactics/TA0009/", "https://attack.mitre.org/tactics/TA0002/", "https://attack.mitre.org/tactics/TA0040/", "https://attack.mitre.org/tactics/TA0043/", "https://attack.mitre.org/tactics/TA0011/", "https://attack.mitre.org/tactics/TA0008/", "https://attack.mitre.org/tactics/TA0042/", "https://attack.mitre.org/tactics/TA0006/", "https://attack.mitre.org/tactics/TA0007/", "https://attack.mitre.org/tactics/TA0003/" ] }, "title": { "type": "string", "enum": [ "Privilege Escalation", "Exfiltration", "Defense Evasion", "Initial Access", "Collection", "Execution", "Impact", "Reconnaissance", "Command and Control", "Lateral Movement", "Resource Development", "Credential Access", "Discovery", "Persistence" ] }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "id", "value", "phase_name", "priority", "url", "title", "count" ] } } }, "required": [ "total_count", "data" ] }, "short_id": { "type": "string", "x-nullable": true }, "source": { "type": "object", "properties": { "total_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string" }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "value", "count" ] } } }, "required": [ "total_count", "data" ] }, "severity": { "type": "object", "properties": { "total_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "data": { "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string" }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "value", "count" ] } } }, "required": [ "total_count", "data" ] } }, "required": [ "event_count", "last_seen_event", "first_seen_event", "sources", "indicators", "observables", "targets", "casebooks", "incident", "linked_incidents", "investigations", "linked_references", "primary_investigation", "mitre_data", "source", "severity" ] } }, "required": [ "endpoint_url", "data" ] }, "incident_graph": { "type": "object", "properties": { "endpoint_url": { "type": "string" }, "data": { "type": "object", "properties": { "nodes": { "type": "object", "additionalProperties": { "type": "object", "properties": { "data": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "asset_id": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "indicators": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "internal": { "type": "boolean" }, "incoming-edges": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "value": { "type": "string" } }, "required": [ "id", "value" ] }, "uniqueItems": true }, "outgoing-edges": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "value": { "type": "string" } }, "required": [ "id", "value" ] }, "uniqueItems": true }, "investigated": { "type": "boolean" }, "is_asset": { "type": "boolean" }, "observableType": { "type": "string" }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" } }, "required": [ "type", "value", "disposition", "investigated" ] } }, "properties": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": {} }, "required": [ "name", "value" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": {} }, "required": [ "name", "value" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": {} }, "required": [ "name", "value" ] } } ] }, "modules": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "title": { "type": "string" }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." } }, "required": [ "type", "value", "indicators", "internal", "incoming-edges", "outgoing-edges", "investigated", "is_asset", "observableType", "observables", "modules", "sightings", "sources", "title" ] }, "times": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "integer", "format": "int64" } }, "required": [ "time" ] }, "uniqueItems": true } }, "required": [ "data", "times" ] } }, "edges": { "type": "object", "additionalProperties": { "type": "object", "properties": { "id1": { "type": "string" }, "id2": { "type": "string" }, "times": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "integer", "format": "int64" } }, "required": [ "time" ] }, "uniqueItems": true }, "data": { "type": "object", "properties": { "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "value": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "relation_info": {} }, "required": [ "value", "sightings" ] } }, "required": [ "id1", "id2", "times", "data" ] } }, "errors": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "E_DATA_TOO_LARGE" ] }, "message": { "type": "string" } }, "required": [ "type", "message" ] } } }, "required": [ "nodes", "edges" ] } }, "required": [ "endpoint_url", "data" ] }, "incident_errors": { "type": "object", "properties": { "endpoint_url": { "type": "string" }, "data": { "type": "array", "items": { "type": "object", "properties": { "module_instance_id": { "type": "string", "format": "uuid" }, "module_type_id": { "type": "string", "format": "uuid" }, "module": { "type": "string", "x-nullable": true }, "type": { "type": "string", "enum": [ "fatal", "warning", "error" ] }, "code": { "type": "string" }, "message": { "type": "string" } }, "required": [ "module_instance_id", "module_type_id", "type", "code", "message" ] } } }, "required": [ "endpoint_url", "data" ] }, "incident_worklog": { "type": "object", "properties": { "endpoint_url": { "type": "string" }, "data": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "content": { "type": "string" }, "user_id": { "type": "string", "x-nullable": true }, "title": { "type": "string", "example": "Executed Workflow for Document and Notify", "description": "This will either be Executed Workflow or Added Note for task title" }, "entity_url": { "type": "string", "x-nullable": true, "example": "https://xdr.int.iroh.site/automate/runs/028L3SUZON9CK10YLshABO5xtYk0ICTqjr8", "description": "a link to the automate run information" }, "event_time": { "type": "string", "format": "date-time", "example": "2023-10-18T20:16:06.000Z" }, "event_type": { "type": "string", "enum": [ "private-intel/incident/updated", "private-intel/incident/created", "private-intel/note/created", "auto/workflow/task/start/success", "auto/workflow/task/start/failure", "auto/workflow/started", "auto/workflow/errored", "auto/workflow/completed", "playbook/task/state", "playbook/phase/state" ] }, "meta": { "type": "object", "properties": { "incident": { "type": "object", "properties": {} }, "workflow": { "type": "object", "properties": { "input": { "type": "object", "properties": { "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" } }, "required": [ "type", "value" ] } } }, "required": [ "observables" ] } }, "required": [ "input" ] }, "updated_field": { "type": "object", "properties": { "field": { "type": "string" }, "action": { "type": "string", "enum": [ "modified", "added", "deleted" ] }, "value": { "type": "object", "properties": { "before": {}, "after": {} } } }, "required": [ "field", "action", "value" ] } }, "x-nullable": true } }, "required": [ "id", "content", "user_id", "title", "entity_url", "event_time", "event_type", "meta" ] } } }, "required": [ "endpoint_url", "data" ] }, "incident_events": { "type": "object", "properties": { "endpoint_url": { "type": "string" }, "data": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "id": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "observed_time": { "type": "object", "properties": { "start_time": { "type": "string" }, "end_time": { "type": "string", "x-nullable": true } }, "required": [ "start_time" ] }, "type": { "type": "string", "enum": [ "sighting" ] }, "context": { "x-nullable": true }, "data": { "type": "object", "properties": { "columns": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "type": { "type": "string", "enum": [ "integer", "markdown", "number", "observable", "string", "url" ] }, "description": { "type": "string", "x-nullable": true }, "required": { "type": "boolean" }, "short_description": { "type": "string", "x-nullable": true } }, "required": [ "name", "type" ] } }, "rows": { "type": "array", "items": {} }, "row_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "columns", "rows" ] }, "external_ids": { "type": "array", "items": { "type": "string" } }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "internal": { "type": "boolean" }, "language": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "resolution": { "type": "string", "enum": [ "allowed", "blocked", "contained", "detected" ] }, "sensor": { "type": "string" }, "sensor_coordinates": { "type": "object", "properties": { "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "os": { "type": "string" }, "type": { "type": "string" } }, "required": [ "observables", "type" ] }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "timestamp": { "type": "string" }, "compacted_entities": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, "compacted_relations": { "type": "array", "items": { "type": "object", "properties": { "source": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "related": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "relation": { "type": "string" }, "origin": { "type": "string" } }, "required": [ "source", "related", "relation" ] }, "uniqueItems": true }, "title": { "type": "string", "x-nullable": true }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] }, "notability": { "type": "object", "properties": { "first_seen_target": { "type": "object", "properties": { "label": { "type": "string" }, "targets": { "type": "array", "items": {}, "uniqueItems": true } }, "required": [ "label", "targets" ] }, "severity": { "type": "object", "properties": { "label": { "type": "string" } }, "required": [ "label" ] }, "mitre-attack": { "type": "object", "properties": { "label": { "type": "string" } }, "required": [ "label" ] }, "first_seen_indicator": { "type": "object", "properties": { "label": { "type": "string" }, "indicators": { "type": "array", "items": {}, "uniqueItems": true } }, "required": [ "label", "indicators" ] }, "original_event": { "type": "object", "properties": { "label": { "type": "string" } }, "required": [ "label" ] } } }, "mitreData": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "enum": [ "TA0004", "TA0010", "TA0005", "TA0001", "TA0009", "TA0002", "TA0040", "TA0043", "TA0011", "TA0008", "TA0042", "TA0006", "TA0007", "TA0003" ] }, "value": { "type": "string", "enum": [ "TA0004", "TA0010", "TA0005", "TA0001", "TA0009", "TA0002", "TA0040", "TA0043", "TA0011", "TA0008", "TA0042", "TA0006", "TA0007", "TA0003" ] }, "phase_name": { "type": "string", "enum": [ "privilege-escalation", "exfiltration", "defense-evasion", "initial-access", "collection", "execution", "impact", "reconnaissance", "command-and-control", "lateral-movement", "resource-development", "credential-access", "discovery", "persistence" ] }, "priority": { "type": "integer", "enum": [ 6, 12, 7, 3, 10, 4, 13, 1, 11, 9, 2, 8, 8, 5 ] }, "url": { "type": "string", "enum": [ "https://attack.mitre.org/tactics/TA0004/", "https://attack.mitre.org/tactics/TA0010/", "https://attack.mitre.org/tactics/TA0005/", "https://attack.mitre.org/tactics/TA0001/", "https://attack.mitre.org/tactics/TA0009/", "https://attack.mitre.org/tactics/TA0002/", "https://attack.mitre.org/tactics/TA0040/", "https://attack.mitre.org/tactics/TA0043/", "https://attack.mitre.org/tactics/TA0011/", "https://attack.mitre.org/tactics/TA0008/", "https://attack.mitre.org/tactics/TA0042/", "https://attack.mitre.org/tactics/TA0006/", "https://attack.mitre.org/tactics/TA0007/", "https://attack.mitre.org/tactics/TA0003/" ] }, "title": { "type": "string", "enum": [ "Privilege Escalation", "Exfiltration", "Defense Evasion", "Initial Access", "Collection", "Execution", "Impact", "Reconnaissance", "Command and Control", "Lateral Movement", "Resource Development", "Credential Access", "Discovery", "Persistence" ] } }, "required": [ "id", "value", "phase_name", "priority", "url", "title" ] }, "uniqueItems": true }, "notable": { "type": "boolean" }, "original": { "type": "boolean" }, "indicators": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "indicator" ], "example": "indicator", "description": "The fixed value indicator" }, "schema_version": { "type": "string", "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "x-nullable": true, "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "x-nullable": true, "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "x-nullable": true, "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "x-nullable": true, "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "The time range during which this Indicator is considered valid." }, "producer": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "Critical" }, "negate": { "type": "boolean", "example": true, "description": "Specifies the absence of the pattern." }, "indicator_type": { "type": "array", "items": { "type": "string", "enum": [ "Anonymization", "C2", "Compromised PKI Certificate", "Domain Watchlist", "Exfiltration", "File Hash Watchlist", "Host Characteristics", "IMEI Watchlist", "IMSI Watchlist", "IP Watchlist", "Login Name", "Malicious E-mail", "Malware Artifacts", "Private Threat Feed", "URL Watchlist" ], "example": "Anonymization" }, "example": [ "Anonymization" ], "description": "Specifies the type or types for this Indicator." }, "tags": { "type": "array", "items": { "type": "string" }, "x-nullable": true, "example": [ "string" ], "description": "Descriptors for this indicator." }, "composite_indicator_expression": { "type": "object", "properties": { "operator": { "type": "string", "enum": [ "and", "not", "or" ], "example": "and" }, "indicator_ids": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an indicator." }, "example": [ "string" ] } }, "required": [ "operator", "indicator_ids" ], "example": { "operator": "and", "indicator_ids": [ "string" ] } }, "likely_impact": { "type": "string", "example": "string", "description": "Likely potential impact within the relevant context if this Indicator were to occur." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "level of confidence held in the accuracy of this Indicator." }, "kill_chain_phases": { "type": "array", "items": { "type": "object", "properties": { "kill_chain_name": { "type": "string", "example": "string", "description": "The name of the kill chain." }, "phase_name": { "type": "string", "example": "string", "description": "The name of the phase in the kill chain." } }, "required": [ "kill_chain_name", "phase_name" ], "example": { "kill_chain_name": "string", "phase_name": "string" }, "description": "The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives." }, "example": [ { "kill_chain_name": "string", "phase_name": "string" } ], "description": "Relevant kill chain phases indicated by this Indicator." }, "test_mechanisms": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "example": [ "string" ], "description": "Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator." }, "specification": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Judgement" ], "example": "Judgement" }, "judgements": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to a judgement." }, "example": [ "string" ] }, "required_judgements": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "source": { "type": "string", "example": "string" }, "relationship": { "type": "string", "example": "string" }, "judgement_id": { "type": "string", "example": "string", "description": "A URI leading to a judgement." } }, "required": [ "judgement_id" ], "example": { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } }, "example": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "required": [ "type", "judgements", "required_judgements" ], "example": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] }, "description": "An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.", "x-anyOf": [ { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Judgement" ], "example": "Judgement" }, "judgements": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to a judgement." }, "example": [ "string" ] }, "required_judgements": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "source": { "type": "string", "example": "string" }, "relationship": { "type": "string", "example": "string" }, "judgement_id": { "type": "string", "example": "string", "description": "A URI leading to a judgement." } }, "required": [ "judgement_id" ], "example": { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } }, "example": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "required": [ "type", "judgements", "required_judgements" ], "example": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] }, "description": "An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "ThreatBrain" ], "example": "ThreatBrain" }, "query": { "type": "string", "example": "string" }, "variables": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ] } }, "required": [ "type", "variables" ], "example": { "type": "ThreatBrain", "query": "string", "variables": [ "string" ] }, "description": "An indicator which runs in threatbrain..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Snort" ], "example": "Snort" }, "snort_sig": { "type": "string", "example": "string" } }, "required": [ "type", "snort_sig" ], "example": { "type": "Snort", "snort_sig": "string" }, "description": "An indicator which runs in snort..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "SIOC" ], "example": "SIOC" }, "SIOC": { "type": "string", "example": "string" } }, "required": [ "type", "SIOC" ], "example": { "type": "SIOC", "SIOC": "string" }, "description": "An indicator which runs in snort..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "OpenIOC" ], "example": "OpenIOC" }, "open_IOC": { "type": "string", "example": "string" } }, "required": [ "type", "open_IOC" ], "example": { "type": "OpenIOC", "open_IOC": "string" }, "description": "An indicator which contains an XML blob of an openIOC indicator." } ] }, "value": { "title": "Event.Indicator.Value", "type": "string", "example": "W32.AdditionVariableCommandObfuscation.ioc", "description": "The canonical label for an indicator." } }, "required": [ "id", "producer", "value" ], "example": { "description": "string", "tags": [ "string" ], "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "producer": "string", "schema_version": "1.3.30", "revision": 10, "type": "indicator", "test_mechanisms": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "composite_indicator_expression": { "operator": "and", "indicator_ids": [ "string" ] }, "title": "string", "likely_impact": "string", "indicator_type": [ "Anonymization" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "severity": "Critical", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "negate": true, "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "specification": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "description": "An indicator is a test, or a collection of judgements that define\ncriteria for identifying the activity, or presence of malware, or\nother unwanted software.\n\nWe follow the\n[STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/)\nclosely, with the exception of not including observables within the\nindicator, and preferring a _specification_ object encoded in JSON as\nopposed to an opaque _implementation_ block.\n\nAdditional, you will want to either define judgements against\nObservables that are linked to this indicator, with the ID in the\n_indicators_ field of those Judgements, or you can provide a\n_specification_ value." } }, "investigationId": { "type": "string", "x-nullable": true }, "investigationShortDescription": { "type": "string", "x-nullable": true }, "investigationSource": { "type": "string", "x-nullable": true }, "targets": { "type": "array", "items": { "type": "object", "properties": { "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "type": { "title": "TargetTypeEnum", "type": "string", "enum": [ "device", "person", "user", "email", "endpoint.sensor", "process.network-scanner", "network.switch", "network.security_manager", "process.vulnerability-scanner", "network.hub", "network.ids", "network.firewall", "process", "network.sense_making", "process.sandbox", "network.modem", "process.email-service", "process.dns-server", "network.vpn", "process.connection-scanner", "network.nic", "endpoint.printer", "network.gateway", "process.reputation-service", "process.remediation-service", "network", "process.virtualization-service", "network.ips", "endpoint.smart-meter", "endpoint.digital-telephone-handset", "endpoint.workstation", "endpoint.server", "network.wap", "endpoint.laptop", "process.aaa-server", "process.directory-service", "endpoint.pos-terminal", "network.bridge", "process.file-scanner", "network.proxy", "endpoint", "process.location-service", "network.sensor", "endpoint.smart-phone", "network.hips", "process.anti-virus-scanner", "endpoint.tablet", "network.guard", "network.router" ], "example": "endpoint", "description": "The targe type/actuator that best fits the device." }, "value": { "title": "TargetSummary.Value", "type": "string", "example": "CARGO-Example", "description": "The targe type/actuator that best fits the device." }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The numerical value of the Device. Will Default to 10 if the Target is resolved.", "example": 2, "x-nullable": true, "default": 7 }, "is_asset": { "title": "TargetSummary.IsAssetEnum", "enum": [ true ], "type": "boolean", "example": true, "description": "Always true for targets." }, "observableType": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The observable type of the defining target observable" }, "observables": { "title": "TargetSummary.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true, "description": "The observable type of the defining target observable" }, "asset_id": { "title": "TargetSummary.AssetId", "type": "string", "example": "4911bbf5-aa42-463b-9a47-65f24140cfe4", "description": "The Device/User Insights ID of this Person or Device.", "x-nullable": true }, "properties": { "title": "TargetSummary.Properties", "type": "array", "items": { "type": "object", "properties": { "name": { "title": "Property.Name", "type": "string", "description": "An open vocabulary string that describes the name of the property.", "example": "cisco:ctr:labels" }, "value": { "title": "Property.Value", "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": {} } ], "description": "The value of the named property.", "example": [ "example label", 1, [ "it can be a string or an int or a vector of anything" ] ] } }, "required": [ "name", "value" ] }, "uniqueItems": true, "description": "The List of Device or Person properties for this resolved Person/Device." } }, "required": [ "type", "value", "is_asset", "observableType", "observables", "asset_id", "properties" ] } }, "relations": { "type": "array", "items": { "type": "object", "properties": { "origin": { "type": "string" }, "relation": { "type": "string" }, "related": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ], "x-anyOf": [ { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ] }, { "type": "object", "properties": { "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "type": { "title": "TargetTypeEnum", "type": "string", "enum": [ "device", "person", "user", "email", "endpoint.sensor", "process.network-scanner", "network.switch", "network.security_manager", "process.vulnerability-scanner", "network.hub", "network.ids", "network.firewall", "process", "network.sense_making", "process.sandbox", "network.modem", "process.email-service", "process.dns-server", "network.vpn", "process.connection-scanner", "network.nic", "endpoint.printer", "network.gateway", "process.reputation-service", "process.remediation-service", "network", "process.virtualization-service", "network.ips", "endpoint.smart-meter", "endpoint.digital-telephone-handset", "endpoint.workstation", "endpoint.server", "network.wap", "endpoint.laptop", "process.aaa-server", "process.directory-service", "endpoint.pos-terminal", "network.bridge", "process.file-scanner", "network.proxy", "endpoint", "process.location-service", "network.sensor", "endpoint.smart-phone", "network.hips", "process.anti-virus-scanner", "endpoint.tablet", "network.guard", "network.router" ], "example": "endpoint", "description": "The targe type/actuator that best fits the device." }, "value": { "title": "TargetSummary.Value", "type": "string", "example": "CARGO-Example", "description": "The targe type/actuator that best fits the device." }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The numerical value of the Device. Will Default to 10 if the Target is resolved.", "example": 2, "x-nullable": true, "default": 7 }, "is_asset": { "title": "TargetSummary.IsAssetEnum", "enum": [ true ], "type": "boolean", "example": true, "description": "Always true for targets." }, "observableType": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The observable type of the defining target observable" }, "observables": { "title": "TargetSummary.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true, "description": "The observable type of the defining target observable" }, "asset_id": { "title": "TargetSummary.AssetId", "type": "string", "example": "4911bbf5-aa42-463b-9a47-65f24140cfe4", "description": "The Device/User Insights ID of this Person or Device.", "x-nullable": true }, "properties": { "title": "TargetSummary.Properties", "type": "array", "items": { "type": "object", "properties": { "name": { "title": "Property.Name", "type": "string", "description": "An open vocabulary string that describes the name of the property.", "example": "cisco:ctr:labels" }, "value": { "title": "Property.Value", "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": {} } ], "description": "The value of the named property.", "example": [ "example label", 1, [ "it can be a string or an int or a vector of anything" ] ] } }, "required": [ "name", "value" ] }, "uniqueItems": true, "description": "The List of Device or Person properties for this resolved Person/Device." } }, "required": [ "type", "value", "is_asset", "observableType", "observables", "asset_id", "properties" ] } ] }, "source": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ], "x-anyOf": [ { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ] }, { "type": "object", "properties": { "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "type": { "title": "TargetTypeEnum", "type": "string", "enum": [ "device", "person", "user", "email", "endpoint.sensor", "process.network-scanner", "network.switch", "network.security_manager", "process.vulnerability-scanner", "network.hub", "network.ids", "network.firewall", "process", "network.sense_making", "process.sandbox", "network.modem", "process.email-service", "process.dns-server", "network.vpn", "process.connection-scanner", "network.nic", "endpoint.printer", "network.gateway", "process.reputation-service", "process.remediation-service", "network", "process.virtualization-service", "network.ips", "endpoint.smart-meter", "endpoint.digital-telephone-handset", "endpoint.workstation", "endpoint.server", "network.wap", "endpoint.laptop", "process.aaa-server", "process.directory-service", "endpoint.pos-terminal", "network.bridge", "process.file-scanner", "network.proxy", "endpoint", "process.location-service", "network.sensor", "endpoint.smart-phone", "network.hips", "process.anti-virus-scanner", "endpoint.tablet", "network.guard", "network.router" ], "example": "endpoint", "description": "The targe type/actuator that best fits the device." }, "value": { "title": "TargetSummary.Value", "type": "string", "example": "CARGO-Example", "description": "The targe type/actuator that best fits the device." }, "asset_value": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "The numerical value of the Device. Will Default to 10 if the Target is resolved.", "example": 2, "x-nullable": true, "default": 7 }, "is_asset": { "title": "TargetSummary.IsAssetEnum", "enum": [ true ], "type": "boolean", "example": true, "description": "Always true for targets." }, "observableType": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The observable type of the defining target observable" }, "observables": { "title": "TargetSummary.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] }, "uniqueItems": true, "description": "The observable type of the defining target observable" }, "asset_id": { "title": "TargetSummary.AssetId", "type": "string", "example": "4911bbf5-aa42-463b-9a47-65f24140cfe4", "description": "The Device/User Insights ID of this Person or Device.", "x-nullable": true }, "properties": { "title": "TargetSummary.Properties", "type": "array", "items": { "type": "object", "properties": { "name": { "title": "Property.Name", "type": "string", "description": "An open vocabulary string that describes the name of the property.", "example": "cisco:ctr:labels" }, "value": { "title": "Property.Value", "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "integer", "format": "int64" }, { "type": "array", "items": {} } ], "description": "The value of the named property.", "example": [ "example label", 1, [ "it can be a string or an int or a vector of anything" ] ] } }, "required": [ "name", "value" ] }, "uniqueItems": true, "description": "The List of Device or Person properties for this resolved Person/Device." } }, "required": [ "type", "value", "is_asset", "observableType", "observables", "asset_id", "properties" ] } ] }, "origin_uri": { "type": "string" }, "relation_info": {} }, "required": [ "origin", "relation", "related", "source" ] } }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "title": { "title": "DecoratedObservable.Title", "type": "string", "example": "1234...abcd", "description": "A displayable (truncated) version of the value of this observable." }, "internal": { "title": "DecoratedObservable.Internal", "type": "boolean", "example": true, "description": "If this observable was seen in an internal event." }, "sources": { "title": "DecoratedObservable.Sources", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "x-nullable": true, "example": [ "Crowdstrike" ], "description": "The sources that reported this observable" }, "is_asset": { "title": "DecoratedObservable.IsAssetFalse", "enum": [ false ], "description": "An Indicator if this is a Device or Target.", "example": false, "type": "boolean" }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" } }, "required": [ "type", "value", "disposition", "title", "is_asset", "investigated" ] } }, "tactics_and_techniques": { "type": "array", "items": { "title": "Mitre tactics and Techniques", "type": "object", "properties": { "id": { "title": "MitreID", "type": "string", "example": "TA0003", "description": "MITRE ATT&CK ID" }, "external_id": { "title": "MitreExternalId", "type": "string", "example": "TA0003", "description": "MITRE ATT&CK ID" }, "title": { "title": "MitreTitle", "type": "string", "example": "Persistence" }, "short_description": { "title": "MitreShortDescription", "type": "string", "x-nullable": true, "example": "Persistence" }, "description": { "title": "MitreDescription", "type": "string", "example": "The adversary is trying to maintain their foothold.\n\nPersistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code." }, "score": { "title": "MitreScore", "type": "integer", "format": "int64", "minimum": 1, "maximum": 1000, "x-nullable": true, "example": 44 }, "source_url": { "title": "MitreSourceURL", "type": "string", "x-nullable": true, "example": "https://attack.mitre.org/techniques/TA0003", "description": "The source url for this tactic or technique" }, "mitre_type": { "type": "string", "enum": [ "tactic", "technique", "subtechnique" ] } }, "required": [ "id", "external_id", "title", "short_description", "description", "score", "source_url", "mitre_type" ], "description": "A MITRE object from https://attack.mitre.org/" } } }, "required": [ "confidence", "count", "id", "observed_time", "type", "notable", "original", "targets", "relations", "observables" ] } } }, "required": [ "endpoint_url", "data" ] } }, "required": [ "incident_id" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" }, { "in": "query", "name": "fields", "description": "", "type": "array", "required": false, "items": { "type": "string", "enum": [ "incident_events", "incident_worklog", "incident_summary", "incident_errors", "incident_graph" ] }, "x-anyOf": [ { "type": "array", "items": { "type": "string", "enum": [ "incident_events", "incident_worklog", "incident_summary", "incident_errors", "incident_graph" ] } }, { "type": "string", "example": "string", "description": "String with at most 1024 characters." } ] } ], "tags": [ "v2", "Incident" ], "summary": "Get a full summary of the incident, everything seen in XDR", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/incident/{incident-id}/import": { "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "201": { "schema": { "type": "object", "properties": { "incident_id": { "type": "string" }, "short_id": { "type": "string", "x-nullable": true } }, "required": [ "incident_id" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v2", "Incident" ], "summary": "Import Incident and all its surrounding threat context from CTIA", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/sighting/{sighting-id}/findings": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": {} } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "sighting-id", "description": "", "type": "string", "required": true, "example": "0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v2", "Sighting" ], "summary": "Get the findings for a sighting ID", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/report/incident-status-by-assignment": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": {} } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "query", "name": "period", "description": "", "type": "string", "required": false, "enum": [ "last_hour", "last_24_hours", "last_7_days", "last_30_days", "last_60_days", "last_90_days" ] } ], "tags": [ "v2", "Report" ], "summary": "Incident counts by status and assignment bucket", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/report/mitre-attack-incidents": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": {} } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "query", "name": "period", "description": "", "type": "string", "required": false, "enum": [ "last_hour", "last_24_hours", "last_7_days", "last_30_days", "last_60_days", "last_90_days" ] } ], "tags": [ "v2", "Report" ], "summary": "Non-closed incident counts by MITRE tactic and technique", "description": "Each tactic's `incident_count` is the number of distinct non-closed incidents mapped to that tactic in the selected period. Each technique's `incident_count` is the number of distinct incidents mapped to that technique (subtechniques roll up to their parent technique).\n\nThe sum of per-technique counts under a tactic may differ from the tactic-level count: an incident typically maps to several techniques within the same tactic, so it is counted once at the tactic level but once per technique it maps to at the technique level. Clients should use the tactic-level count for tactic totals, not a sum over techniques.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/report/top-seen-techniques": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": {} } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "query", "name": "period", "description": "", "type": "string", "required": false, "enum": [ "last_hour", "last_24_hours", "last_7_days", "last_30_days", "last_60_days", "last_90_days" ] } ], "tags": [ "v2", "Report" ], "summary": "Top seen techniques across incidents", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/report/detection-sources-histogram": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": {} } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "query", "name": "period", "description": "", "type": "string", "required": false, "enum": [ "last_hour", "last_24_hours", "last_7_days", "last_30_days", "last_60_days", "last_90_days" ] } ], "tags": [ "v2", "Report" ], "summary": "Daily incident counts per detection source", "description": "Returns one row per `(detection_source, day)` pair where `day` is the UTC-aligned calendar day on which the incident was created. Each `incident_count` is the number of distinct non-deleted incidents in the requesting org tagged with that detection source on that day.\n\nAn incident tagged with multiple detection sources on the same day contributes 1 to each source's bucket on that day; the sum of per-source counts is therefore \u2265 the total incident count for the period.\n\nEmpty `(source, day)` pairs are omitted from the response \u2014 clients that need zero-filled time series should reshape on their end.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/report/top-targeted-devices": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": {} } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "query", "name": "period", "description": "", "type": "string", "required": false, "enum": [ "last_hour", "last_24_hours", "last_7_days", "last_30_days", "last_60_days", "last_90_days" ] } ], "tags": [ "v2", "Report" ], "summary": "Top targeted devices across incidents", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/report/top-targeted-users": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": {} } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "query", "name": "period", "description": "", "type": "string", "required": false, "enum": [ "last_hour", "last_24_hours", "last_7_days", "last_30_days", "last_60_days", "last_90_days" ] } ], "tags": [ "v2", "Report" ], "summary": "Top targeted users across incidents", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/report/top-targeted-assets": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": {} } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "query", "name": "period", "description": "", "type": "string", "required": false, "enum": [ "last_hour", "last_24_hours", "last_7_days", "last_30_days", "last_60_days", "last_90_days" ] } ], "tags": [ "v2", "Report" ], "summary": "Top targeted assets across incidents", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/report/team-mean-time-to-engage": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "current_avg": { "type": "integer", "format": "int64", "x-nullable": true }, "prior_avg": { "type": "integer", "format": "int64", "x-nullable": true } }, "required": [ "current_avg", "prior_avg" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "query", "name": "period", "description": "", "type": "string", "required": false, "enum": [ "last_hour", "last_24_hours", "last_7_days", "last_30_days", "last_60_days", "last_90_days" ] } ], "tags": [ "v2", "Report" ], "summary": "Team mean time to engage over the period", "description": "Returns `{current_avg, prior_avg}` in seconds, averaged over incidents in the requesting org created during the selected period (`current_avg`) and during the immediately-preceding window of the same size (`prior_avg`). Each value is the rounded mean of `(opened - created_at)` in seconds \u2014 the queue time before an analyst moved the incident off New. Rows where `opened < created_at` (CTIA/distributor clock skew, backfilled imports) are excluded. A window with no qualifying incidents yields `null`. Clients compute the delta to render period-over-period.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/report/user-mean-time-to-engage": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "current_avg": { "type": "integer", "format": "int64", "x-nullable": true }, "prior_avg": { "type": "integer", "format": "int64", "x-nullable": true } }, "required": [ "current_avg", "prior_avg" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "query", "name": "period", "description": "", "type": "string", "required": false, "enum": [ "last_hour", "last_24_hours", "last_7_days", "last_30_days", "last_60_days", "last_90_days" ] } ], "tags": [ "v2", "Report" ], "summary": "Requesting user's mean time to engage over the period", "description": "Same shape and semantics as `/team-mean-time-to-engage`, additionally filtered to incidents the requesting user is assigned to via `incident_assignee`. The user is taken from the JWT caller \u2014 there is no `?user_id=` parameter. A user with no qualifying assigned incidents in a window yields `null` for that window's average.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/report/team-mean-time-to-contain": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "current_avg": { "type": "integer", "format": "int64", "x-nullable": true }, "prior_avg": { "type": "integer", "format": "int64", "x-nullable": true } }, "required": [ "current_avg", "prior_avg" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "query", "name": "period", "description": "", "type": "string", "required": false, "enum": [ "last_hour", "last_24_hours", "last_7_days", "last_30_days", "last_60_days", "last_90_days" ] } ], "tags": [ "v2", "Report" ], "summary": "Team mean time to contain over the period", "description": "Returns `{current_avg, prior_avg}` in seconds, averaged over incidents in the requesting org created during the selected period (`current_avg`) and during the immediately-preceding window of the same size (`prior_avg`). Each value is the rounded mean of `(contained - created_at)` in seconds \u2014 the containment time from incident creation to when it was marked contained. Rows where `contained < created_at` (CTIA/distributor clock skew, backfilled imports) are excluded. Rows where `contained` is `NULL` are also excluded \u2014 pre-deploy incidents (before migration 20260605120000) and incidents that have not been contained both fall in this bucket; the column populates fully within ~30 days of deploy, which matches the dashboard's max window. A window with no qualifying incidents yields `null`. Clients compute the delta to render period-over-period.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/report/user-mean-time-to-contain": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "current_avg": { "type": "integer", "format": "int64", "x-nullable": true }, "prior_avg": { "type": "integer", "format": "int64", "x-nullable": true } }, "required": [ "current_avg", "prior_avg" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "query", "name": "period", "description": "", "type": "string", "required": false, "enum": [ "last_hour", "last_24_hours", "last_7_days", "last_30_days", "last_60_days", "last_90_days" ] } ], "tags": [ "v2", "Report" ], "summary": "User mean time to contain over the period", "description": "Same shape and semantics as `team-mean-time-to-contain`, but restricted to incidents the requesting user is assigned to via `incident_assignee`. An incident with multiple assignees is counted once for each assignee \u2014 the user's own `current_avg` is unaffected by other assignees on the same incident.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/report/team-mean-time-to-resolve": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "current_avg": { "type": "integer", "format": "int64", "x-nullable": true }, "prior_avg": { "type": "integer", "format": "int64", "x-nullable": true } }, "required": [ "current_avg", "prior_avg" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "query", "name": "period", "description": "", "type": "string", "required": false, "enum": [ "last_hour", "last_24_hours", "last_7_days", "last_30_days", "last_60_days", "last_90_days" ] } ], "tags": [ "v2", "Report" ], "summary": "Team mean time to resolve over the period", "description": "Returns `{current_avg, prior_avg}` in seconds, averaged over incidents in the requesting org created during the selected period (`current_avg`) and during the immediately-preceding window of the same size (`prior_avg`). Each value is the rounded mean of `(closed - opened)` in seconds, where `opened` is the timestamp the incident was first set to a non-`New` status (incidents created already at a non-`New` status contribute a near-zero `(opened - created_at)` and a real `(closed - opened)` once they close). Never-closed incidents are excluded (the delta is undefined). Rows where `closed < opened` (CTIA/distributor clock skew, backfilled imports) are also excluded. A window with no qualifying incidents yields `null`. Clients compute the delta to render period-over-period.\n\nWindow bucketing matches the engage tile: incidents are filtered by `created_at` within the period, then their `(closed - opened)` is averaged. Long-tail incidents that haven't closed yet by query time aren't included in the average \u2014 a survivorship bias accepted in exchange for cross-tile consistency.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v2/report/user-mean-time-to-resolve": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "current_avg": { "type": "integer", "format": "int64", "x-nullable": true }, "prior_avg": { "type": "integer", "format": "int64", "x-nullable": true } }, "required": [ "current_avg", "prior_avg" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "query", "name": "period", "description": "", "type": "string", "required": false, "enum": [ "last_hour", "last_24_hours", "last_7_days", "last_30_days", "last_60_days", "last_90_days" ] } ], "tags": [ "v2", "Report" ], "summary": "Requesting user's mean time to resolve over the period", "description": "Same as `/team-mean-time-to-resolve`, but restricted to incidents the requesting user is assigned to via `incident_assignee`. The user is identified from the JWT, not from a query parameter \u2014 clients cannot query MTTR for another user. Tokens without a user claim (e.g. service tokens) get a 400 response \u2014 use the team variant for org-wide numbers.\n\nEach value is the rounded mean of `(closed - opened)` in seconds for incidents created during the period and assigned to the requesting user. A user may be one of several assignees on an incident; the incident still counts exactly once for their average.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v3/incident/filters": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "detection_sources": { "type": "array", "items": { "type": "string" } }, "tactics": { "type": "array", "items": { "type": "string" } }, "techniques": { "type": "array", "items": { "type": "string" } } } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [], "tags": [ "v3" ], "summary": "incident search filter values", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v3/incident/search": { "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": { "assignees": { "type": "array", "items": { "type": "string" } }, "categories": { "type": "array", "items": { "type": "string", "enum": [ "Attrition", "Denial of Service", "Exercise", "Exercise/Network Defense Testing", "Explained Anomaly", "Forensics", "Improper Usage", "Intelligence", "Investigating", "Investigation", "Malicious Code", "Malicious Logic", "Non-Compliant", "Reconnaissance", "Root Level", "Scans/Probes/Attempted Access", "Unauthorized Access", "Unsuccessful", "User Level", "eDiscovery" ] } }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "detection_sources": { "type": "array", "items": { "type": "string" } }, "detection_status": { "title": "DetectionStatusType", "type": "string", "enum": [ "active", "inactive_merged", "inactive_expired", "inactive_oversized", "inactive_user_closed" ], "description": "Whether the incident is actively receiving detection data updates" }, "discovery_method": { "type": "string", "enum": [ "SecureX Threat Hunting", "Agent Disclosure", "Antivirus", "Audit", "Customer", "External - Fraud Detection", "Financial Audit", "HIPS", "IT Audit", "Incident Response", "Internal - Fraud Detection", "Law Enforcement", "Log Review", "Monitoring Service", "NIDS", "Security Alarm", "Unknown", "Unrelated Party", "User" ] }, "incident_time": { "type": "object", "properties": { "opened": { "type": "string" }, "closed": { "type": "string" }, "discovered": { "type": "string" }, "rejected": { "type": "string" }, "remediated": { "type": "string" }, "reported": { "type": "string" } }, "required": [ "opened" ] }, "intended_effect": { "type": "string", "enum": [ "Account Takeover", "Advantage", "Advantage - Economic", "Advantage - Military", "Advantage - Political", "Brand Damage", "Competitive Advantage", "Degradation of Service", "Denial and Deception", "Destruction", "Disruption", "Embarrassment", "Exposure", "Extortion", "Fraud", "Harassment", "ICS Control", "Theft", "Theft - Credential Theft", "Theft - Identity Theft", "Theft - Intellectual Property", "Theft - Theft of Proprietary Information", "Traffic Diversion", "Unauthorized Access" ] }, "last_activity": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "date-time" } ], "x-nullable": true }, "meta": { "type": "object", "properties": { "ai_description": { "type": "boolean" }, "helios_report_generated": { "type": "boolean" } } }, "promotion_method": { "type": "string", "enum": [ "Automated", "Manual" ] }, "scores": { "type": "object", "properties": { "asset": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 10 }, "global": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 1000 }, "ml_score": { "type": "number", "format": "double" }, "ttp": { "type": "integer", "format": "int64", "minimum": 0, "maximum": 100 } } }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_id": { "type": "string", "x-nullable": true }, "status": { "title": "IncidentStatusType", "type": "string", "enum": [ "New", "Closed", "Open: Recovered", "Closed: Other", "Hold: Internal", "Hold: Legal", "Closed: Under Review", "Rejected", "Open", "Closed: Merged", "Restoration Achieved", "Incident Reported", "Closed: Suspected", "Stalled", "Open: Contained", "Closed: Near-Miss", "Hold: External", "Containment Achieved", "New: Processing", "Closed: Confirmed Threat", "Closed: False Positive", "Open: Reported", "Open: Investigating", "Hold", "New: Presented" ], "description": "The status of the incident" }, "tactics": { "type": "array", "items": { "type": "string" } }, "techniques": { "type": "array", "items": { "type": "string" } }, "id": { "type": "string" }, "description": { "type": "string" }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "title": { "type": "string" }, "language": { "type": "string" }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "external_ids": { "type": "array", "items": { "type": "string" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] } } } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "limit": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "offset": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "sort_by": { "type": "array", "items": { "type": "object", "properties": { "field": { "type": "string", "enum": [ "title", "scores", "status", "created_at", "updated_at", "last_activity", "short_id" ] }, "direction": { "type": "string", "enum": [ "asc", "desc" ] } }, "required": [ "field", "direction" ] } }, "filters": { "type": "object", "properties": { "id": { "type": "object", "properties": { "include": { "type": "array", "items": { "type": "string" } }, "exclude": { "type": "array", "items": { "type": "string" } } }, "description": "The incident ids to include or explicitly exclude from the search.", "example": "{\"include\":[\"7889a175-f43c-42ad-baac-ff55497c1730\",\"incident-7889a175-f43c-42ad-baac-ff55497c1730\",\"https://private.intel.int.iroh.site:443/ctia/incident/incident-7889a175-f43c-42ad-baac-ff55497c1730\"],\"exclude\":[\"b2f76042-74f2-4697-a474-7dcdc04145f5\",\"incident-b2f76042-74f2-4697-a474-7dcdc04145f5\",\"https://private.intel.int.iroh.site:443/ctia/incident/incident-b2f76042-74f2-4697-a474-7dcdc04145f5\"]}" }, "status": { "type": "object", "properties": { "include": { "type": "array", "items": { "type": "string" } }, "exclude": { "type": "array", "items": { "type": "string" } } }, "description": "The incident statuses to include or explicitly exclude from the search.", "example": "{\"include\":[\"New: Waiting\"],\"exclude\":[\"New: Processing\"]}" }, "detection_status": { "type": "object", "properties": { "include": { "type": "array", "items": { "title": "DetectionStatusType", "type": "string", "enum": [ "active", "inactive_merged", "inactive_expired", "inactive_oversized", "inactive_user_closed" ], "description": "Whether the incident is actively receiving detection data updates" } }, "exclude": { "type": "array", "items": { "title": "DetectionStatusType", "type": "string", "enum": [ "active", "inactive_merged", "inactive_expired", "inactive_oversized", "inactive_user_closed" ], "description": "Whether the incident is actively receiving detection data updates" } } }, "description": "The incident lifecycle (detection_status) values to include or explicitly exclude from the search.", "example": "{\"include\":[\"active\"],\"exclude\":[\"inactive_oversized\"]}" }, "score": { "type": "object", "properties": { "min": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "max": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "description": "The minimum and/or maximum global score (inclusive).", "example": "{\"min\":10,\"max\":1000}" }, "assignees": { "type": "object", "properties": { "include": { "type": "array", "items": { "type": "string" } }, "exclude": { "type": "array", "items": { "type": "string" } }, "exists": { "type": "boolean" } } }, "detection_sources": { "type": "object", "properties": { "include": { "type": "array", "items": { "type": "string" } }, "exclude": { "type": "array", "items": { "type": "string" } } } }, "tactics": { "type": "object", "properties": { "include": { "type": "array", "items": { "type": "string" } }, "exclude": { "type": "array", "items": { "type": "string" } } }, "description": "Mitre Tactic ids to include or explicitly exclude from the search. Wildcards like 'TA01*' are allowed.", "example": "{\"include\":[\"TA0011\"],\"exclude\":[\"TA01*\"]}" }, "techniques": { "type": "object", "properties": { "include": { "type": "array", "items": { "type": "string" } }, "exclude": { "type": "array", "items": { "type": "string" } } }, "description": "Mitre Technique or sub-Technique ids to include or explicitly exclude from the search. Wildcards like 'T01*' are allowed.", "example": "{\"include\":[\"T0011\"],\"exclude\":[\"T01*\"]}" }, "short_id": { "type": "string", "description": "Exact match filter for incident short_id. Accepts with or without INC- prefix.", "example": "INC-123" }, "created_at": { "type": "object", "properties": { "start_date": { "type": "string" }, "end_date": { "type": "string" } }, "description": "The search range (inclusive; bounded or unbounded) of the date(s) at which incidents first arrive in conure", "example": "{\"start_date\":\"2025-05-01T00:00:00.000Z\",\"end_date\":\"2025-05-31T23:59:59.999Z\"}" }, "last_activity": { "type": "object", "properties": { "start_date": { "type": "string" }, "end_date": { "type": "string" } }, "description": "The search range (inclusive; bounded or unbounded) of the date(s) at which an incident was either linked to another incident or received a new sighting.", "example": "{\"start_date\":\"2025-05-01T00:00:00.000Z\",\"end_date\":\"2025-05-31T23:59:59.999Z\"}" }, "updated_at": { "type": "object", "properties": { "start_date": { "type": "string" }, "end_date": { "type": "string" } }, "description": "The search range (inclusive; bounded or unbounded) of the date(s) at which incidents were last updated in conure", "example": "{\"start_date\":\"2025-05-01T00:00:00.000Z\",\"end_date\":\"2025-05-31T23:59:59.999Z\"}" }, "opened": { "type": "object", "properties": { "start_date": { "type": "string" }, "end_date": { "type": "string" } }, "description": "The search range of the date(s) at which incidents were opened.", "example": "{\"start_date\":\"2025-05-01T00:00:00.000Z\",\"end_date\":\"2025-05-31T23:59:59.999Z\"}" }, "closed": { "type": "object", "properties": { "start_date": { "type": "string" }, "end_date": { "type": "string" } }, "description": "The search range of the date(s) at which incidents were closed.", "example": "{\"start_date\":\"2025-05-01T00:00:00.000Z\",\"end_date\":\"2025-05-31T23:59:59.999Z\"}" }, "discovered": { "type": "object", "properties": { "start_date": { "type": "string" }, "end_date": { "type": "string" } }, "description": "The search range of the date(s) at which incidents were discovered.", "example": "{\"start_date\":\"2025-05-01T00:00:00.000Z\",\"end_date\":\"2025-05-31T23:59:59.999Z\"}" }, "reported": { "type": "object", "properties": { "start_date": { "type": "string" }, "end_date": { "type": "string" } }, "description": "The search range of the date(s) at which incidents were reported.", "example": "{\"start_date\":\"2025-05-01T00:00:00.000Z\",\"end_date\":\"2025-05-31T23:59:59.999Z\"}" }, "remediated": { "type": "object", "properties": { "start_date": { "type": "string" }, "end_date": { "type": "string" } }, "description": "The search range of the date(s) at which incidents were remediated.", "example": "{\"start_date\":\"2025-05-01T00:00:00.000Z\",\"end_date\":\"2025-05-31T23:59:59.999Z\"}" }, "rejected": { "type": "object", "properties": { "start_date": { "type": "string" }, "end_date": { "type": "string" } }, "description": "The search range of the date(s) at which incidents were rejected.", "example": "{\"start_date\":\"2025-05-01T00:00:00.000Z\",\"end_date\":\"2025-05-31T23:59:59.999Z\"}" } } }, "fields": { "type": "array", "items": { "type": "string", "enum": [ "assignees", "categories", "confidence", "created_at", "description", "detection_sources", "detection_status", "discovery_method", "external_ids", "external_references", "id", "incident_time", "intended_effect", "language", "last_activity", "meta", "owner", "promotion_method", "revision", "schema_version", "scores", "severity", "short_description", "short_id", "source", "source_uri", "status", "tactics", "techniques", "title", "tlp", "type", "updated_at" ] }, "description": "The list of fields to return for each incident in the search results", "example": "[\"id\",\"status\",\"scores\",\"description\",\"updated_at\"]" }, "search_text": { "type": "string", "description": "A simple string that is searched across 'id', 'title', 'description', 'short_description', 'source', and exact short_id matches", "example": "malicious process detected" } } } } ], "tags": [ "v3" ], "summary": "Search incidents", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v3/incident/{incident-id}/events": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "array", "items": { "type": "object", "properties": { "compacted_entities": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, "compacted_relations": { "type": "array", "items": { "type": "object", "properties": { "source": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "related": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "relation": { "type": "string" }, "origin": { "type": "string" } }, "required": [ "source", "related", "relation" ] }, "uniqueItems": true }, "notability": { "type": "object", "properties": { "first_seen_target": { "type": "object", "properties": { "label": { "type": "string" }, "targets": { "type": "array", "items": {}, "uniqueItems": true } }, "required": [ "label", "targets" ] }, "severity": { "type": "object", "properties": { "label": { "type": "string" } }, "required": [ "label" ] }, "mitre-attack": { "type": "object", "properties": { "label": { "type": "string" } }, "required": [ "label" ] }, "first_seen_indicator": { "type": "object", "properties": { "label": { "type": "string" }, "indicators": { "type": "array", "items": {}, "uniqueItems": true } }, "required": [ "label", "indicators" ] }, "original_event": { "type": "object", "properties": { "label": { "type": "string" } }, "required": [ "label" ] } } }, "mitreData": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "enum": [ "TA0004", "TA0010", "TA0005", "TA0001", "TA0009", "TA0002", "TA0040", "TA0043", "TA0011", "TA0008", "TA0042", "TA0006", "TA0007", "TA0003" ] }, "value": { "type": "string", "enum": [ "TA0004", "TA0010", "TA0005", "TA0001", "TA0009", "TA0002", "TA0040", "TA0043", "TA0011", "TA0008", "TA0042", "TA0006", "TA0007", "TA0003" ] }, "phase_name": { "type": "string", "enum": [ "privilege-escalation", "exfiltration", "defense-evasion", "initial-access", "collection", "execution", "impact", "reconnaissance", "command-and-control", "lateral-movement", "resource-development", "credential-access", "discovery", "persistence" ] }, "priority": { "type": "integer", "enum": [ 6, 12, 7, 3, 10, 4, 13, 1, 11, 9, 2, 8, 8, 5 ] }, "url": { "type": "string", "enum": [ "https://attack.mitre.org/tactics/TA0004/", "https://attack.mitre.org/tactics/TA0010/", "https://attack.mitre.org/tactics/TA0005/", "https://attack.mitre.org/tactics/TA0001/", "https://attack.mitre.org/tactics/TA0009/", "https://attack.mitre.org/tactics/TA0002/", "https://attack.mitre.org/tactics/TA0040/", "https://attack.mitre.org/tactics/TA0043/", "https://attack.mitre.org/tactics/TA0011/", "https://attack.mitre.org/tactics/TA0008/", "https://attack.mitre.org/tactics/TA0042/", "https://attack.mitre.org/tactics/TA0006/", "https://attack.mitre.org/tactics/TA0007/", "https://attack.mitre.org/tactics/TA0003/" ] }, "title": { "type": "string", "enum": [ "Privilege Escalation", "Exfiltration", "Defense Evasion", "Initial Access", "Collection", "Execution", "Impact", "Reconnaissance", "Command and Control", "Lateral Movement", "Resource Development", "Credential Access", "Discovery", "Persistence" ] } }, "required": [ "id", "value", "phase_name", "priority", "url", "title" ] }, "uniqueItems": true }, "notable": { "type": "boolean" }, "original": { "type": "boolean" }, "indicators": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "indicator" ], "example": "indicator", "description": "The fixed value indicator" }, "schema_version": { "type": "string", "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "x-nullable": true, "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "x-nullable": true, "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "x-nullable": true, "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "x-nullable": true, "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "The time range during which this Indicator is considered valid." }, "producer": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "Critical" }, "negate": { "type": "boolean", "example": true, "description": "Specifies the absence of the pattern." }, "indicator_type": { "type": "array", "items": { "type": "string", "enum": [ "Anonymization", "C2", "Compromised PKI Certificate", "Domain Watchlist", "Exfiltration", "File Hash Watchlist", "Host Characteristics", "IMEI Watchlist", "IMSI Watchlist", "IP Watchlist", "Login Name", "Malicious E-mail", "Malware Artifacts", "Private Threat Feed", "URL Watchlist" ], "example": "Anonymization" }, "example": [ "Anonymization" ], "description": "Specifies the type or types for this Indicator." }, "tags": { "type": "array", "items": { "type": "string" }, "x-nullable": true, "example": [ "string" ], "description": "Descriptors for this indicator." }, "composite_indicator_expression": { "type": "object", "properties": { "operator": { "type": "string", "enum": [ "and", "not", "or" ], "example": "and" }, "indicator_ids": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an indicator." }, "example": [ "string" ] } }, "required": [ "operator", "indicator_ids" ], "example": { "operator": "and", "indicator_ids": [ "string" ] } }, "likely_impact": { "type": "string", "example": "string", "description": "Likely potential impact within the relevant context if this Indicator were to occur." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "level of confidence held in the accuracy of this Indicator." }, "kill_chain_phases": { "type": "array", "items": { "type": "object", "properties": { "kill_chain_name": { "type": "string", "example": "string", "description": "The name of the kill chain." }, "phase_name": { "type": "string", "example": "string", "description": "The name of the phase in the kill chain." } }, "required": [ "kill_chain_name", "phase_name" ], "example": { "kill_chain_name": "string", "phase_name": "string" }, "description": "The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives." }, "example": [ { "kill_chain_name": "string", "phase_name": "string" } ], "description": "Relevant kill chain phases indicated by this Indicator." }, "test_mechanisms": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "example": [ "string" ], "description": "Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator." }, "specification": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Judgement" ], "example": "Judgement" }, "judgements": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to a judgement." }, "example": [ "string" ] }, "required_judgements": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "source": { "type": "string", "example": "string" }, "relationship": { "type": "string", "example": "string" }, "judgement_id": { "type": "string", "example": "string", "description": "A URI leading to a judgement." } }, "required": [ "judgement_id" ], "example": { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } }, "example": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "required": [ "type", "judgements", "required_judgements" ], "example": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] }, "description": "An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.", "x-anyOf": [ { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Judgement" ], "example": "Judgement" }, "judgements": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to a judgement." }, "example": [ "string" ] }, "required_judgements": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "source": { "type": "string", "example": "string" }, "relationship": { "type": "string", "example": "string" }, "judgement_id": { "type": "string", "example": "string", "description": "A URI leading to a judgement." } }, "required": [ "judgement_id" ], "example": { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } }, "example": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "required": [ "type", "judgements", "required_judgements" ], "example": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] }, "description": "An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "ThreatBrain" ], "example": "ThreatBrain" }, "query": { "type": "string", "example": "string" }, "variables": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ] } }, "required": [ "type", "variables" ], "example": { "type": "ThreatBrain", "query": "string", "variables": [ "string" ] }, "description": "An indicator which runs in threatbrain..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Snort" ], "example": "Snort" }, "snort_sig": { "type": "string", "example": "string" } }, "required": [ "type", "snort_sig" ], "example": { "type": "Snort", "snort_sig": "string" }, "description": "An indicator which runs in snort..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "SIOC" ], "example": "SIOC" }, "SIOC": { "type": "string", "example": "string" } }, "required": [ "type", "SIOC" ], "example": { "type": "SIOC", "SIOC": "string" }, "description": "An indicator which runs in snort..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "OpenIOC" ], "example": "OpenIOC" }, "open_IOC": { "type": "string", "example": "string" } }, "required": [ "type", "open_IOC" ], "example": { "type": "OpenIOC", "open_IOC": "string" }, "description": "An indicator which contains an XML blob of an openIOC indicator." } ] }, "value": { "title": "Event.Indicator.Value", "type": "string", "example": "W32.AdditionVariableCommandObfuscation.ioc", "description": "The canonical label for an indicator." } }, "required": [ "id", "producer", "value" ], "example": { "description": "string", "tags": [ "string" ], "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "producer": "string", "schema_version": "1.3.30", "revision": 10, "type": "indicator", "test_mechanisms": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "composite_indicator_expression": { "operator": "and", "indicator_ids": [ "string" ] }, "title": "string", "likely_impact": "string", "indicator_type": [ "Anonymization" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "severity": "Critical", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "negate": true, "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "specification": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "description": "An indicator is a test, or a collection of judgements that define\ncriteria for identifying the activity, or presence of malware, or\nother unwanted software.\n\nWe follow the\n[STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/)\nclosely, with the exception of not including observables within the\nindicator, and preferring a _specification_ object encoded in JSON as\nopposed to an opaque _implementation_ block.\n\nAdditional, you will want to either define judgements against\nObservables that are linked to this indicator, with the ID in the\n_indicators_ field of those Judgements, or you can provide a\n_specification_ value." } }, "investigationId": { "type": "string", "x-nullable": true }, "investigationShortDescription": { "type": "string", "x-nullable": true }, "investigationSource": { "type": "string", "x-nullable": true }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "id": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "observed_time": { "type": "object", "properties": { "start_time": { "type": "string" }, "end_time": { "type": "string", "x-nullable": true } }, "required": [ "start_time" ] }, "type": { "type": "string", "enum": [ "sighting" ] }, "context": { "x-nullable": true }, "data": { "type": "object", "properties": { "columns": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "type": { "type": "string", "enum": [ "integer", "markdown", "number", "observable", "string", "url" ] }, "description": { "type": "string", "x-nullable": true }, "required": { "type": "boolean" }, "short_description": { "type": "string", "x-nullable": true } }, "required": [ "name", "type" ] } }, "rows": { "type": "array", "items": {} }, "row_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "columns", "rows" ] }, "external_ids": { "type": "array", "items": { "type": "string" } }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "internal": { "type": "boolean" }, "language": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "resolution": { "type": "string", "enum": [ "allowed", "blocked", "contained", "detected" ] }, "sensor": { "type": "string" }, "sensor_coordinates": { "type": "object", "properties": { "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "os": { "type": "string" }, "type": { "type": "string" } }, "required": [ "observables", "type" ] }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "timestamp": { "type": "string" }, "title": { "type": "string", "x-nullable": true }, "tactics_and_techniques": { "type": "array", "items": { "title": "Mitre tactics and Techniques", "type": "object", "properties": { "id": { "title": "MitreID", "type": "string", "example": "TA0003", "description": "MITRE ATT&CK ID" }, "external_id": { "title": "MitreExternalId", "type": "string", "example": "TA0003", "description": "MITRE ATT&CK ID" }, "title": { "title": "MitreTitle", "type": "string", "example": "Persistence" }, "short_description": { "title": "MitreShortDescription", "type": "string", "x-nullable": true, "example": "Persistence" }, "description": { "title": "MitreDescription", "type": "string", "example": "The adversary is trying to maintain their foothold.\n\nPersistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code." }, "score": { "title": "MitreScore", "type": "integer", "format": "int64", "minimum": 1, "maximum": 1000, "x-nullable": true, "example": 44 }, "source_url": { "title": "MitreSourceURL", "type": "string", "x-nullable": true, "example": "https://attack.mitre.org/techniques/TA0003", "description": "The source url for this tactic or technique" }, "mitre_type": { "type": "string", "enum": [ "tactic", "technique", "subtechnique" ] } }, "required": [ "id", "external_id", "title", "short_description", "description", "score", "source_url", "mitre_type" ], "description": "A MITRE object from https://attack.mitre.org/" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] } }, "required": [ "notable", "original", "confidence", "count", "id", "observed_time", "type" ] } }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident you would like to retrieve related events for.", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" }, { "description": "A integer greater than 0.", "format": "int64", "name": "limit", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "description": "A integer greater than 0.", "format": "int64", "name": "offset", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "in": "query", "name": "sort", "description": "", "type": "string", "required": false, "enum": [ "asc", "desc" ], "allowEmptyValue": true }, { "in": "query", "name": "order", "description": "", "type": "string", "required": false, "enum": [ "start_time", "time", "title", "severity", "source" ], "allowEmptyValue": true }, { "in": "query", "name": "important_only", "description": "Include only important events", "type": "boolean", "required": false }, { "in": "query", "name": "notable", "description": "", "type": "boolean", "required": false }, { "in": "query", "name": "source", "description": "", "type": "array", "required": false, "items": { "type": "string" }, "x-anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "string", "allowEmptyValue": true } ] }, { "in": "query", "name": "severity", "description": "", "type": "array", "required": false, "items": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "x-anyOf": [ { "type": "array", "items": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] } }, { "type": "string", "allowEmptyValue": true } ] }, { "in": "query", "name": "type", "description": "", "type": "array", "required": false, "items": { "type": "string", "enum": [ "Original", "Investigated" ] }, "x-anyOf": [ { "type": "array", "items": { "type": "string", "enum": [ "Original", "Investigated" ] } }, { "type": "string", "allowEmptyValue": true } ] }, { "in": "query", "name": "search_text", "description": "", "type": "string", "required": false } ], "tags": [ "v3", "Incident Routes using Entities" ], "summary": "Incident Events", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v3/incident/{incident-id}/storyboard": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": {}, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident you would like to retrieve related events for.", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" } ], "tags": [ "v3", "Incident Routes using Entities" ], "summary": "XDR 2.0 Output for Incidents", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v3/incident/{incident-id}/storyboard/feedback": { "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "201": { "schema": {}, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident you would like to retrieve related events for.", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" }, { "in": "body", "name": "body", "description": "", "required": true, "schema": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "general", "verdict" ] }, "report_metadata": { "type": "object", "properties": { "langsmith_trace_id": { "type": "string", "minLength": 1, "maxLength": 300 }, "xdr_chain_id": { "type": "string", "minLength": 1, "maxLength": 300 } }, "required": [ "langsmith_trace_id", "xdr_chain_id" ] }, "feedback_metadata": { "type": "object", "properties": { "status": { "type": "string", "minLength": 1, "maxLength": 300 } }, "x-nullable": true }, "text": { "type": "string", "minLength": 1, "maxLength": 6000 } }, "required": [ "type", "report_metadata", "feedback_metadata", "text" ] } } ], "tags": [ "v3", "Incident Routes using Entities" ], "summary": "Submit storyboard feedback for an incident", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v3/incident/{incident-id}/graph": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "nodes": { "type": "object", "additionalProperties": { "type": "object", "properties": { "data": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "asset_id": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "indicators": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "internal": { "type": "boolean" }, "incoming-edges": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "value": { "type": "string" } }, "required": [ "id", "value" ] }, "uniqueItems": true }, "outgoing-edges": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "value": { "type": "string" } }, "required": [ "id", "value" ] }, "uniqueItems": true }, "investigated": { "type": "boolean" }, "is_asset": { "type": "boolean" }, "observableType": { "type": "string" }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" } }, "required": [ "type", "value", "disposition", "investigated" ] } }, "properties": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": {} }, "required": [ "name", "value" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": {} }, "required": [ "name", "value" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": {} }, "required": [ "name", "value" ] } } ] }, "modules": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "title": { "type": "string" }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." } }, "required": [ "type", "value", "indicators", "internal", "incoming-edges", "outgoing-edges", "investigated", "is_asset", "observableType", "observables", "modules", "sightings", "sources", "title" ] }, "times": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "integer", "format": "int64" } }, "required": [ "time" ] }, "uniqueItems": true } }, "required": [ "data", "times" ] } }, "edges": { "type": "object", "additionalProperties": { "type": "object", "properties": { "id1": { "type": "string" }, "id2": { "type": "string" }, "times": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "integer", "format": "int64" } }, "required": [ "time" ] }, "uniqueItems": true }, "data": { "type": "object", "properties": { "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "value": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "relation_info": {} }, "required": [ "value", "sightings" ] } }, "required": [ "id1", "id2", "times", "data" ] } }, "errors": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "E_DATA_TOO_LARGE" ] }, "message": { "type": "string" } }, "required": [ "type", "message" ] } } }, "required": [ "nodes", "edges" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident you would like to retrieve related events for.", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" }, { "in": "query", "name": "important_observables", "description": "Include only data that is related to an important observable", "type": "boolean", "required": false }, { "in": "query", "name": "important_sightings", "description": "Include only data from important events", "type": "boolean", "required": false }, { "in": "query", "name": "important_only", "description": "Include only data from important events", "type": "boolean", "required": false }, { "in": "query", "name": "include_process_parents", "description": "Include parent processes when rendering execution relationships", "type": "boolean", "required": false } ], "tags": [ "v3", "Incident Routes using Entities" ], "summary": "Graph Endpoint from entities.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] }, "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "nodes": { "type": "object", "additionalProperties": { "type": "object", "properties": { "data": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "asset_id": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "indicators": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "internal": { "type": "boolean" }, "incoming-edges": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "value": { "type": "string" } }, "required": [ "id", "value" ] }, "uniqueItems": true }, "outgoing-edges": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "value": { "type": "string" } }, "required": [ "id", "value" ] }, "uniqueItems": true }, "investigated": { "type": "boolean" }, "is_asset": { "type": "boolean" }, "observableType": { "type": "string" }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" } }, "required": [ "type", "value", "disposition", "investigated" ] } }, "properties": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": {} }, "required": [ "name", "value" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": {} }, "required": [ "name", "value" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": {} }, "required": [ "name", "value" ] } } ] }, "modules": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "title": { "type": "string" }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." } }, "required": [ "type", "value", "indicators", "internal", "incoming-edges", "outgoing-edges", "investigated", "is_asset", "observableType", "observables", "modules", "sightings", "sources", "title" ] }, "times": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "integer", "format": "int64" } }, "required": [ "time" ] }, "uniqueItems": true } }, "required": [ "data", "times" ] } }, "edges": { "type": "object", "additionalProperties": { "type": "object", "properties": { "id1": { "type": "string" }, "id2": { "type": "string" }, "times": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "integer", "format": "int64" } }, "required": [ "time" ] }, "uniqueItems": true }, "data": { "type": "object", "properties": { "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "value": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "relation_info": {} }, "required": [ "value", "sightings" ] } }, "required": [ "id1", "id2", "times", "data" ] } }, "errors": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "E_DATA_TOO_LARGE" ] }, "message": { "type": "string" } }, "required": [ "type", "message" ] } } }, "required": [ "nodes", "edges" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "The non-URL qualified ID of the incident you would like to retrieve related events for.", "type": "string", "required": true, "example": "incident-0a38949f-d192-4d30-91ae-e593c1f57c14" }, { "in": "query", "name": "important_observables", "description": "Include only data that is related to an important observable", "type": "boolean", "required": false }, { "in": "query", "name": "important_sightings", "description": "Include only data from important events", "type": "boolean", "required": false }, { "in": "query", "name": "important_only", "description": "Include only data from important events", "type": "boolean", "required": false }, { "in": "query", "name": "include_process_parents", "description": "Include parent processes when rendering execution relationships", "type": "boolean", "required": false }, { "in": "body", "name": "body", "description": "", "required": false, "schema": { "type": "object", "properties": { "important_observables": { "description": "Include only data that is related to an important observable", "type": "boolean" }, "important_sightings": { "description": "Include only data from important events", "type": "boolean" }, "important_only": { "description": "Include only data from important events", "type": "boolean" }, "include_process_parents": { "description": "Include parent processes when rendering execution relationships", "type": "boolean" } }, "x-nullable": true } } ], "tags": [ "v3", "Incident Routes using Entities" ], "summary": "Graph Endpoint from entities.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v3/incident/{incident-id}/entity/{entity-id}": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "title": "Entity.EntityDetail", "type": "object", "properties": { "entity": { "type": "object", "properties": { "id": { "title": "Entity.ID", "type": "uuid", "example": "f1b0631b-d370-4de1-ad48-1df4d7b9e7de", "description": "The ID for an entity." }, "type": { "title": "Entity.Type.Enum", "type": "string", "enum": [ "device", "user", "hash", "attachment", "email" ], "description": "The type of the entity", "example": "device" }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" }, "label": { "title": "Entity.Label", "type": "string", "example": "link.exe", "description": "The canonical label for an entity" }, "ips": { "title": "Entity.Device.IPs", "type": "array", "items": { "type": "string" }, "example": [ "192.168.1.64", "192.168.1.163" ], "description": "The ip addresses of a device" } }, "required": [ "id", "type", "disposition", "investigated", "label" ], "x-anyOf": [ { "type": "object", "properties": { "id": { "title": "Entity.ID", "type": "uuid", "example": "f1b0631b-d370-4de1-ad48-1df4d7b9e7de", "description": "The ID for an entity." }, "type": { "title": "Entity.Type.Enum", "type": "string", "enum": [ "device", "user", "hash", "attachment", "email" ], "description": "The type of the entity", "example": "device" }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" }, "label": { "title": "Entity.Label", "type": "string", "example": "link.exe", "description": "The canonical label for an entity" }, "ips": { "title": "Entity.Device.IPs", "type": "array", "items": { "type": "string" }, "example": [ "192.168.1.64", "192.168.1.163" ], "description": "The ip addresses of a device" } }, "required": [ "id", "type", "disposition", "investigated", "label" ] }, { "type": "object", "properties": { "id": { "title": "Entity.ID", "type": "uuid", "example": "f1b0631b-d370-4de1-ad48-1df4d7b9e7de", "description": "The ID for an entity." }, "type": { "title": "Entity.Type.Enum", "type": "string", "enum": [ "device", "user", "hash", "attachment", "email" ], "description": "The type of the entity", "example": "device" }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" }, "label": { "title": "Entity.Label", "type": "string", "example": "link.exe", "description": "The canonical label for an entity" }, "names": { "title": "Entity.Device.Names", "type": "array", "items": { "type": "string" }, "example": [ "link@hyrule.net", "link" ], "description": "The names assocated with a user" } }, "required": [ "id", "type", "disposition", "investigated", "label", "names" ] }, { "type": "object", "properties": { "id": { "title": "Entity.ID", "type": "uuid", "example": "f1b0631b-d370-4de1-ad48-1df4d7b9e7de", "description": "The ID for an entity." }, "type": { "title": "Entity.Type.Enum", "type": "string", "enum": [ "device", "user", "hash", "attachment", "email" ], "description": "The type of the entity", "example": "device" }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" }, "label": { "title": "Entity.Label", "type": "string", "example": "link.exe", "description": "The canonical label for an entity" }, "algorithm": { "title": "Entity.Hash.Algorithm.Enum", "enum": [ [ "sha256", "sha1", "md5" ] ], "description": "The algorithm used to generate this hash", "example": "md5", "type": "string" }, "value": { "title": "Entity.Hash.Value", "type": "string", "description": "The value of the hash", "example": "c804ecb887cbf798f910a71a15771577" } }, "required": [ "id", "type", "disposition", "investigated", "label", "algorithm", "value" ] }, { "type": "object", "properties": { "id": { "title": "Entity.ID", "type": "uuid", "example": "f1b0631b-d370-4de1-ad48-1df4d7b9e7de", "description": "The ID for an entity." }, "type": { "title": "Entity.Type.Enum", "type": "string", "enum": [ "device", "user", "hash", "attachment", "email" ], "description": "The type of the entity", "example": "device" }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" }, "label": { "title": "Entity.Label", "type": "string", "example": "link.exe", "description": "The canonical label for an entity" }, "name": { "title": "Entity.Attachment.Name", "type": "string", "description": "Name of a device", "example": "Link's PC" }, "hashes": { "title": "Entity.Attachment.Hashes", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "description": "The Entity IDs of the hashes associated with this attachment", "example": [ "636712a3-2705-4bdb-9639-de8761b57b2b", "20c93a73-cc3c-4012-b807-38a49ec1bfd7" ] } }, "required": [ "id", "type", "disposition", "investigated", "label", "name", "hashes" ] }, { "type": "object", "properties": { "id": { "title": "Entity.ID", "type": "uuid", "example": "f1b0631b-d370-4de1-ad48-1df4d7b9e7de", "description": "The ID for an entity." }, "type": { "title": "Entity.Type.Enum", "type": "string", "enum": [ "device", "user", "hash", "attachment", "email" ], "description": "The type of the entity", "example": "device" }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" }, "label": { "title": "Entity.Label", "type": "string", "example": "link.exe", "description": "The canonical label for an entity" }, "from": { "title": "Entity.Email.From", "type": "string", "example": "86518fc4-9401-4ebf-be28-730d2cb91762", "description": "The Entity ID of the user who sent the email" }, "to": { "title": "Entity.Email.To", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "description": "The Entity IDs of the users who received the email", "example": [ "759201b1-bfa2-4e6c-9a66-858e470d86d4", "06f7cf3a-deb5-4dc6-b08e-b0174d665c10" ] }, "attachment": { "title": "Entity.Email.Attachment", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "description": "The Entity IDs of the email attachments", "example": [ "61d9d2b4-b0f4-46f6-a309-35651ddcd445", "c2977a99-e0d4-4dc0-abe0-1653bf01e543" ] } }, "required": [ "id", "type", "disposition", "investigated", "label", "from", "to", "attachment" ] } ] }, "activities": { "type": "array", "items": { "type": "object", "properties": { "id": { "title": "Entity.ID", "type": "uuid", "example": "f1b0631b-d370-4de1-ad48-1df4d7b9e7de", "description": "The ID for an entity." }, "sighting": { "title": "Activity.Base.Sighting", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "description": "The sightings associated with the activity", "example": [ "45ed81d9-8e32-46e2-b604-7cf19114dd91", "d757f328-827d-4fb0-8729-b63f77289d0a" ] }, "observed_times": { "title": "Activity.Base.ObservedTimes", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "description": "The observed_times associated with the activity", "example": [ "1727117998000" ] }, "edges": { "title": "Activity.Base.Edges", "type": "array", "items": { "title": "Activity.Base.Edges.Edge", "type": "object", "properties": { "source": { "title": "Activity.Base.Edges.Edge.Source", "type": "string", "example": "0617f00c-bcee-4e8b-b18d-3511809c754d", "description": "The Entity ID of the first entity of the relationship" }, "related": { "title": "Activity.Base.Edges.Edge.Related", "type": "string", "example": "d126f865-c0eb-4d9f-9818-260263b3a77f", "description": "The Entity ID of the second entity of the relationship" }, "relation": { "title": "Activity.Base.Edges.Edge.Relation", "type": "string", "example": "Connected To", "description": "The name of the relationship" } }, "required": [ "source", "related", "relation" ], "description": "A relationship representing a discrete part of an activity" }, "description": "The relationships associated with the activity" }, "email_message": { "title": "Activity.EmailSent.EmailMessage", "type": "string", "example": "57c4a6c1-bab0-4994-a652-a4622b4fdc79", "description": "The Entity ID of the sent message" }, "connection_info": { "title": "Activity.EmailSent.ConnectionInfo", "type": "object", "properties": { "from_device": { "title": "Activity.EmailSent.ConnectionInfo.FromDevice", "type": "string", "example": "d5fa73df-c9f9-4444-bcbe-7b7ea8d8dfd8", "description": "The device that relayed the message to the receiving device" }, "to_device": { "title": "Activity.EmailSent.ConnectionInfo.ToDevice", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "description": "The devices that received the message", "example": [ "ef8227ed-95aa-4338-b888-0869ecace0e9", "71dd40ec-a367-4aa9-92ac-e97ff2550428" ] } }, "required": [ "from_device", "to_device" ], "description": "The connection information for the sent email" } }, "required": [ "id", "sighting", "observed_times", "edges", "email_message", "connection_info" ], "x-anyOf": [ { "type": "object", "properties": { "id": { "title": "Entity.ID", "type": "uuid", "example": "f1b0631b-d370-4de1-ad48-1df4d7b9e7de", "description": "The ID for an entity." }, "sighting": { "title": "Activity.Base.Sighting", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "description": "The sightings associated with the activity", "example": [ "45ed81d9-8e32-46e2-b604-7cf19114dd91", "d757f328-827d-4fb0-8729-b63f77289d0a" ] }, "observed_times": { "title": "Activity.Base.ObservedTimes", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "description": "The observed_times associated with the activity", "example": [ "1727117998000" ] }, "edges": { "title": "Activity.Base.Edges", "type": "array", "items": { "title": "Activity.Base.Edges.Edge", "type": "object", "properties": { "source": { "title": "Activity.Base.Edges.Edge.Source", "type": "string", "example": "0617f00c-bcee-4e8b-b18d-3511809c754d", "description": "The Entity ID of the first entity of the relationship" }, "related": { "title": "Activity.Base.Edges.Edge.Related", "type": "string", "example": "d126f865-c0eb-4d9f-9818-260263b3a77f", "description": "The Entity ID of the second entity of the relationship" }, "relation": { "title": "Activity.Base.Edges.Edge.Relation", "type": "string", "example": "Connected To", "description": "The name of the relationship" } }, "required": [ "source", "related", "relation" ], "description": "A relationship representing a discrete part of an activity" }, "description": "The relationships associated with the activity" }, "email_message": { "title": "Activity.EmailSent.EmailMessage", "type": "string", "example": "57c4a6c1-bab0-4994-a652-a4622b4fdc79", "description": "The Entity ID of the sent message" }, "connection_info": { "title": "Activity.EmailSent.ConnectionInfo", "type": "object", "properties": { "from_device": { "title": "Activity.EmailSent.ConnectionInfo.FromDevice", "type": "string", "example": "d5fa73df-c9f9-4444-bcbe-7b7ea8d8dfd8", "description": "The device that relayed the message to the receiving device" }, "to_device": { "title": "Activity.EmailSent.ConnectionInfo.ToDevice", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "description": "The devices that received the message", "example": [ "ef8227ed-95aa-4338-b888-0869ecace0e9", "71dd40ec-a367-4aa9-92ac-e97ff2550428" ] } }, "required": [ "from_device", "to_device" ], "description": "The connection information for the sent email" } }, "required": [ "id", "sighting", "observed_times", "edges", "email_message", "connection_info" ] } ] } } }, "required": [ "entity", "activities" ], "description": "The details for an entity including it's activities" }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "incident-id", "description": "", "type": "string", "required": true }, { "in": "path", "name": "entity-id", "description": "", "type": "string", "required": true } ], "tags": [ "v3", "Incident Routes using Entities" ], "summary": "Get the attributes of an entity", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v3/investigation/{investigation-id}/events": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "events": { "type": "array", "items": { "type": "object", "properties": { "compacted_entities": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, "compacted_relations": { "type": "array", "items": { "type": "object", "properties": { "source": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "related": { "type": "object", "properties": { "type": { "type": "string" }, "is_asset": { "type": "boolean" }, "observables": { "title": "Entity.Observables", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "is_asset": { "type": "boolean" }, "modules": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string", "x-nullable": true }, "uniqueItems": true }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" }, "asset_id": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] } } ], "description": "Observables or Attributes for a grouped Entity" }, "value": { "type": "string" }, "observableType": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean", "x-nullable": true }, "count": { "type": "integer", "format": "int64" }, "sightings": { "type": "array", "items": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "uniqueItems": true } }, "required": [ "type", "value", "disposition" ] }, "relation": { "type": "string" }, "origin": { "type": "string" } }, "required": [ "source", "related", "relation" ] }, "uniqueItems": true }, "notability": { "type": "object", "properties": { "first_seen_target": { "type": "object", "properties": { "label": { "type": "string" }, "targets": { "type": "array", "items": {}, "uniqueItems": true } }, "required": [ "label", "targets" ] }, "severity": { "type": "object", "properties": { "label": { "type": "string" } }, "required": [ "label" ] }, "mitre-attack": { "type": "object", "properties": { "label": { "type": "string" } }, "required": [ "label" ] }, "first_seen_indicator": { "type": "object", "properties": { "label": { "type": "string" }, "indicators": { "type": "array", "items": {}, "uniqueItems": true } }, "required": [ "label", "indicators" ] }, "original_event": { "type": "object", "properties": { "label": { "type": "string" } }, "required": [ "label" ] } } }, "mitreData": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "enum": [ "TA0004", "TA0010", "TA0005", "TA0001", "TA0009", "TA0002", "TA0040", "TA0043", "TA0011", "TA0008", "TA0042", "TA0006", "TA0007", "TA0003" ] }, "value": { "type": "string", "enum": [ "TA0004", "TA0010", "TA0005", "TA0001", "TA0009", "TA0002", "TA0040", "TA0043", "TA0011", "TA0008", "TA0042", "TA0006", "TA0007", "TA0003" ] }, "phase_name": { "type": "string", "enum": [ "privilege-escalation", "exfiltration", "defense-evasion", "initial-access", "collection", "execution", "impact", "reconnaissance", "command-and-control", "lateral-movement", "resource-development", "credential-access", "discovery", "persistence" ] }, "priority": { "type": "integer", "enum": [ 6, 12, 7, 3, 10, 4, 13, 1, 11, 9, 2, 8, 8, 5 ] }, "url": { "type": "string", "enum": [ "https://attack.mitre.org/tactics/TA0004/", "https://attack.mitre.org/tactics/TA0010/", "https://attack.mitre.org/tactics/TA0005/", "https://attack.mitre.org/tactics/TA0001/", "https://attack.mitre.org/tactics/TA0009/", "https://attack.mitre.org/tactics/TA0002/", "https://attack.mitre.org/tactics/TA0040/", "https://attack.mitre.org/tactics/TA0043/", "https://attack.mitre.org/tactics/TA0011/", "https://attack.mitre.org/tactics/TA0008/", "https://attack.mitre.org/tactics/TA0042/", "https://attack.mitre.org/tactics/TA0006/", "https://attack.mitre.org/tactics/TA0007/", "https://attack.mitre.org/tactics/TA0003/" ] }, "title": { "type": "string", "enum": [ "Privilege Escalation", "Exfiltration", "Defense Evasion", "Initial Access", "Collection", "Execution", "Impact", "Reconnaissance", "Command and Control", "Lateral Movement", "Resource Development", "Credential Access", "Discovery", "Persistence" ] } }, "required": [ "id", "value", "phase_name", "priority", "url", "title" ] }, "uniqueItems": true }, "notable": { "type": "boolean" }, "original": { "type": "boolean" }, "indicators": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "string", "description": "Globally unique URI identifying this object." }, "type": { "type": "string", "enum": [ "indicator" ], "example": "indicator", "description": "The fixed value indicator" }, "schema_version": { "type": "string", "example": "1.3.30", "description": "CTIM schema version for this entity." }, "revision": { "type": "integer", "format": "int64", "example": 10, "description": "A monotonically increasing revision, incremented each time the object is changed." }, "external_ids": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string", "example": "string", "description": "The source within which the external-reference is defined (system, registry, organization, etc.)" }, "description": { "type": "string", "example": "string", "description": "Markdown string with at most 5000 characters." }, "url": { "type": "string", "example": "string", "description": "A URL reference to an external resource." }, "hashes": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ], "description": "Specifies a dictionary of hashes for the contents of the url." }, "external_id": { "type": "string", "example": "string", "description": "An identifier for the external reference content." } }, "required": [ "source_name" ], "example": { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" }, "description": "External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material." }, "example": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "description": "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." }, "timestamp": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "The time this object was created at, or last modified." }, "language": { "type": "string", "example": "string", "description": "The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.\n\nFor example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting." }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ], "example": "green", "description": "TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.\n\nIt is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.\n\nFor example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization." }, "title": { "type": "string", "example": "string", "description": "A short title for this object, used as primary display and reference value." }, "description": { "type": "string", "x-nullable": true, "example": "string", "description": "A description of object, which may be detailed." }, "short_description": { "type": "string", "x-nullable": true, "example": "string", "description": "A single line, short summary of the object." }, "source": { "type": "string", "x-nullable": true, "example": "string", "description": "Represents the source of the intelligence that led to the creation of the entity." }, "source_uri": { "type": "string", "x-nullable": true, "example": "string", "description": "URI of the source of the intelligence that led to the creation of the entity." }, "valid_time": { "type": "object", "properties": { "start_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If not present, the valid time position of the indicator does not have an upper bound." }, "end_time": { "type": "string", "format": "date-time", "example": "2016-01-01T01:01:01Z", "description": "If end_time is not present, then the valid time position of the object does not have an upper bound." } }, "example": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "description": "The time range during which this Indicator is considered valid." }, "producer": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "Critical" }, "negate": { "type": "boolean", "example": true, "description": "Specifies the absence of the pattern." }, "indicator_type": { "type": "array", "items": { "type": "string", "enum": [ "Anonymization", "C2", "Compromised PKI Certificate", "Domain Watchlist", "Exfiltration", "File Hash Watchlist", "Host Characteristics", "IMEI Watchlist", "IMSI Watchlist", "IP Watchlist", "Login Name", "Malicious E-mail", "Malware Artifacts", "Private Threat Feed", "URL Watchlist" ], "example": "Anonymization" }, "example": [ "Anonymization" ], "description": "Specifies the type or types for this Indicator." }, "tags": { "type": "array", "items": { "type": "string" }, "x-nullable": true, "example": [ "string" ], "description": "Descriptors for this indicator." }, "composite_indicator_expression": { "type": "object", "properties": { "operator": { "type": "string", "enum": [ "and", "not", "or" ], "example": "and" }, "indicator_ids": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to an indicator." }, "example": [ "string" ] } }, "required": [ "operator", "indicator_ids" ], "example": { "operator": "and", "indicator_ids": [ "string" ] } }, "likely_impact": { "type": "string", "example": "string", "description": "Likely potential impact within the relevant context if this Indicator were to occur." }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High", "description": "level of confidence held in the accuracy of this Indicator." }, "kill_chain_phases": { "type": "array", "items": { "type": "object", "properties": { "kill_chain_name": { "type": "string", "example": "string", "description": "The name of the kill chain." }, "phase_name": { "type": "string", "example": "string", "description": "The name of the phase in the kill chain." } }, "required": [ "kill_chain_name", "phase_name" ], "example": { "kill_chain_name": "string", "phase_name": "string" }, "description": "The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives." }, "example": [ { "kill_chain_name": "string", "phase_name": "string" } ], "description": "Relevant kill chain phases indicated by this Indicator." }, "test_mechanisms": { "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 2048 characters." }, "example": [ "string" ], "description": "Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator." }, "specification": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Judgement" ], "example": "Judgement" }, "judgements": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to a judgement." }, "example": [ "string" ] }, "required_judgements": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "source": { "type": "string", "example": "string" }, "relationship": { "type": "string", "example": "string" }, "judgement_id": { "type": "string", "example": "string", "description": "A URI leading to a judgement." } }, "required": [ "judgement_id" ], "example": { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } }, "example": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "required": [ "type", "judgements", "required_judgements" ], "example": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] }, "description": "An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.", "x-anyOf": [ { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Judgement" ], "example": "Judgement" }, "judgements": { "type": "array", "items": { "type": "string", "example": "string", "description": "A URI leading to a judgement." }, "example": [ "string" ] }, "required_judgements": { "type": "array", "items": { "type": "object", "properties": { "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ], "example": "High" }, "source": { "type": "string", "example": "string" }, "relationship": { "type": "string", "example": "string" }, "judgement_id": { "type": "string", "example": "string", "description": "A URI leading to a judgement." } }, "required": [ "judgement_id" ], "example": { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } }, "example": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "required": [ "type", "judgements", "required_judgements" ], "example": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] }, "description": "An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "ThreatBrain" ], "example": "ThreatBrain" }, "query": { "type": "string", "example": "string" }, "variables": { "type": "array", "items": { "type": "string", "example": "string" }, "example": [ "string" ] } }, "required": [ "type", "variables" ], "example": { "type": "ThreatBrain", "query": "string", "variables": [ "string" ] }, "description": "An indicator which runs in threatbrain..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "Snort" ], "example": "Snort" }, "snort_sig": { "type": "string", "example": "string" } }, "required": [ "type", "snort_sig" ], "example": { "type": "Snort", "snort_sig": "string" }, "description": "An indicator which runs in snort..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "SIOC" ], "example": "SIOC" }, "SIOC": { "type": "string", "example": "string" } }, "required": [ "type", "SIOC" ], "example": { "type": "SIOC", "SIOC": "string" }, "description": "An indicator which runs in snort..." }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "OpenIOC" ], "example": "OpenIOC" }, "open_IOC": { "type": "string", "example": "string" } }, "required": [ "type", "open_IOC" ], "example": { "type": "OpenIOC", "open_IOC": "string" }, "description": "An indicator which contains an XML blob of an openIOC indicator." } ] }, "value": { "title": "Event.Indicator.Value", "type": "string", "example": "W32.AdditionVariableCommandObfuscation.ioc", "description": "The canonical label for an indicator." } }, "required": [ "id", "producer", "value" ], "example": { "description": "string", "tags": [ "string" ], "valid_time": { "start_time": "2016-01-01T01:01:01Z", "end_time": "2016-01-01T01:01:01Z" }, "producer": "string", "schema_version": "1.3.30", "revision": 10, "type": "indicator", "test_mechanisms": [ "string" ], "source": "string", "external_ids": [ "string" ], "short_description": "string", "composite_indicator_expression": { "operator": "and", "indicator_ids": [ "string" ] }, "title": "string", "likely_impact": "string", "indicator_type": [ "Anonymization" ], "external_references": [ { "source_name": "string", "description": "string", "url": "string", "hashes": [ "string" ], "external_id": "string" } ], "source_uri": "string", "language": "string", "id": "string", "severity": "Critical", "tlp": "green", "kill_chain_phases": [ { "kill_chain_name": "string", "phase_name": "string" } ], "negate": true, "timestamp": "2016-01-01T01:01:01Z", "confidence": "High", "specification": { "type": "Judgement", "judgements": [ "string" ], "required_judgements": [ { "confidence": "High", "source": "string", "relationship": "string", "judgement_id": "string" } ] } }, "description": "An indicator is a test, or a collection of judgements that define\ncriteria for identifying the activity, or presence of malware, or\nother unwanted software.\n\nWe follow the\n[STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/)\nclosely, with the exception of not including observables within the\nindicator, and preferring a _specification_ object encoded in JSON as\nopposed to an opaque _implementation_ block.\n\nAdditional, you will want to either define judgements against\nObservables that are linked to this indicator, with the ID in the\n_indicators_ field of those Judgements, or you can provide a\n_specification_ value." } }, "investigationId": { "type": "string", "x-nullable": true }, "investigationShortDescription": { "type": "string", "x-nullable": true }, "investigationSource": { "type": "string", "x-nullable": true }, "confidence": { "type": "string", "enum": [ "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "id": { "type": "string", "x-anyOf": [ { "type": "string" }, { "type": "string", "format": "uuid" } ] }, "observed_time": { "type": "object", "properties": { "start_time": { "type": "string" }, "end_time": { "type": "string", "x-nullable": true } }, "required": [ "start_time" ] }, "type": { "type": "string", "enum": [ "sighting" ] }, "context": { "x-nullable": true }, "data": { "type": "object", "properties": { "columns": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "type": { "type": "string", "enum": [ "integer", "markdown", "number", "observable", "string", "url" ] }, "description": { "type": "string", "x-nullable": true }, "required": { "type": "boolean" }, "short_description": { "type": "string", "x-nullable": true } }, "required": [ "name", "type" ] } }, "rows": { "type": "array", "items": {} }, "row_count": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 } }, "required": [ "columns", "rows" ] }, "external_ids": { "type": "array", "items": { "type": "string" } }, "external_references": { "type": "array", "items": { "type": "object", "properties": { "source_name": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "url": { "type": "string" }, "description": { "type": "string" }, "external_id": { "type": "string" } }, "required": [ "source_name" ] } }, "internal": { "type": "boolean" }, "language": { "type": "string" }, "revision": { "title": "PositiveInteger", "type": "integer", "format": "int64", "minimum": 0, "description": "A integer greater than 0.", "example": 2 }, "resolution": { "type": "string", "enum": [ "allowed", "blocked", "contained", "detected" ] }, "sensor": { "type": "string" }, "sensor_coordinates": { "type": "object", "properties": { "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ] } }, "os": { "type": "string" }, "type": { "type": "string" } }, "required": [ "observables", "type" ] }, "severity": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "short_description": { "type": "string" }, "source": { "type": "string" }, "source_uri": { "type": "string" }, "timestamp": { "type": "string" }, "title": { "type": "string", "x-nullable": true }, "tactics_and_techniques": { "type": "array", "items": { "title": "Mitre tactics and Techniques", "type": "object", "properties": { "id": { "title": "MitreID", "type": "string", "example": "TA0003", "description": "MITRE ATT&CK ID" }, "external_id": { "title": "MitreExternalId", "type": "string", "example": "TA0003", "description": "MITRE ATT&CK ID" }, "title": { "title": "MitreTitle", "type": "string", "example": "Persistence" }, "short_description": { "title": "MitreShortDescription", "type": "string", "x-nullable": true, "example": "Persistence" }, "description": { "title": "MitreDescription", "type": "string", "example": "The adversary is trying to maintain their foothold.\n\nPersistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code." }, "score": { "title": "MitreScore", "type": "integer", "format": "int64", "minimum": 1, "maximum": 1000, "x-nullable": true, "example": 44 }, "source_url": { "title": "MitreSourceURL", "type": "string", "x-nullable": true, "example": "https://attack.mitre.org/techniques/TA0003", "description": "The source url for this tactic or technique" }, "mitre_type": { "type": "string", "enum": [ "tactic", "technique", "subtechnique" ] } }, "required": [ "id", "external_id", "title", "short_description", "description", "score", "source_url", "mitre_type" ], "description": "A MITRE object from https://attack.mitre.org/" } }, "tlp": { "type": "string", "enum": [ "amber", "green", "red", "white" ] } }, "required": [ "notable", "original", "confidence", "count", "id", "observed_time", "type" ] } } }, "required": [ "events" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "investigation-id", "description": "The investigation in scope", "type": "string", "required": true, "title": "InvestigationId", "format": "uuid", "default": "61399c06-5ea8-44ae-8256-cfcf4437ca5a" }, { "description": "A integer greater than 0.", "format": "int64", "name": "limit", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "description": "A integer greater than 0.", "format": "int64", "name": "offset", "type": "integer", "title": "PositiveInteger", "minimum": 0, "example": 2, "required": false, "in": "query" }, { "in": "query", "name": "sort", "description": "", "type": "string", "required": false, "enum": [ "asc", "desc" ], "allowEmptyValue": true }, { "in": "query", "name": "order", "description": "", "type": "string", "required": false, "enum": [ "start_time", "time", "title", "severity", "source" ], "allowEmptyValue": true }, { "in": "query", "name": "important_only", "description": "Include only important events", "type": "boolean", "required": false }, { "in": "query", "name": "notable", "description": "", "type": "boolean", "required": false }, { "in": "query", "name": "source", "description": "", "type": "array", "required": false, "items": { "type": "string" }, "x-anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "string", "allowEmptyValue": true } ] }, { "in": "query", "name": "severity", "description": "", "type": "array", "required": false, "items": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] }, "x-anyOf": [ { "type": "array", "items": { "type": "string", "enum": [ "Critical", "High", "Info", "Low", "Medium", "None", "Unknown" ] } }, { "type": "string", "allowEmptyValue": true } ] }, { "in": "query", "name": "type", "description": "", "type": "array", "required": false, "items": { "type": "string", "enum": [ "Original", "Investigated" ] }, "x-anyOf": [ { "type": "array", "items": { "type": "string", "enum": [ "Original", "Investigated" ] } }, { "type": "string", "allowEmptyValue": true } ] }, { "in": "query", "name": "search_text", "description": "", "type": "string", "required": false } ], "tags": [ "v3", "Investigation Routes using Entities" ], "summary": "Events endpoint from compacted entities.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v3/investigation/{investigation-id}/graph": { "get": { "responses": { "default": { "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "investigation-id", "description": "", "type": "string", "required": true }, { "in": "query", "name": "important_observables", "description": "Include only data that is related to an important observable", "type": "boolean", "required": false }, { "in": "query", "name": "important_sightings", "description": "Include only data from important events", "type": "boolean", "required": false }, { "in": "query", "name": "important_only", "description": "Include only data from important events", "type": "boolean", "required": false }, { "in": "query", "name": "include_process_parents", "description": "Include parent processes when rendering execution relationships", "type": "boolean", "required": false } ], "tags": [ "v3", "Investigation Routes using Entities" ], "summary": "Graph Endpoint from entities.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] }, "post": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "type": "object", "properties": { "nodes": { "type": "object", "additionalProperties": { "type": "object", "properties": { "data": { "type": "object", "properties": { "type": { "type": "string" }, "value": { "type": "string" }, "asset_id": { "type": "string" }, "disposition": { "type": "integer", "format": "int64" }, "indicators": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "internal": { "type": "boolean" }, "incoming-edges": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "value": { "type": "string" } }, "required": [ "id", "value" ] }, "uniqueItems": true }, "outgoing-edges": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "value": { "type": "string" } }, "required": [ "id", "value" ] }, "uniqueItems": true }, "investigated": { "type": "boolean" }, "is_asset": { "type": "boolean" }, "observableType": { "type": "string" }, "observables": { "type": "array", "items": { "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." }, "disposition": { "type": "integer", "format": "int64" }, "investigated": { "type": "boolean" } }, "required": [ "type", "value", "disposition", "investigated" ] } }, "properties": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": {} }, "required": [ "name", "value" ] }, "uniqueItems": true, "x-anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": {} }, "required": [ "name", "value" ] }, "uniqueItems": true }, { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": {} }, "required": [ "name", "value" ] } } ] }, "modules": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "sources": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "title": { "type": "string" }, "actions_taken": { "title": "ActionsTaken", "type": "array", "items": { "title": "ActionTaken", "type": "object", "properties": { "id": { "title": "ActionTaken.Id", "type": "uuid", "description": "The ID of the Action Instance", "example": "6969efcd-825f-4146-bcb7-a42598c9f624" }, "action": { "title": "ActionTaken.Action", "type": "string", "description": "The direct action that was taken (blocked, quarantined ...)", "example": "blocked" }, "description": { "title": "ActionTaken.Description", "type": "string", "example": "A sha256 was quarantined during view Investigation.", "description": "A string between 1 and 2500 characters representing the markdown content.", "x-nullable": true }, "reason": { "title": "ActionTaken.Reason", "type": "string", "example": "Policy Disabled", "description": "The reason for the failure", "x-nullable": true }, "source": { "title": "ActionTaken.Source", "type": "string", "example": "Crowdstrike", "description": "The source of the alert", "x-nullable": true }, "source_url": { "title": "ActionTaken.SourceURL", "type": "string", "example": "Crowdstrike", "description": "The product specific url of the alert", "x-nullable": true }, "started_at": { "title": "ActionTaken.StartedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was triggered.", "example": "2026-08-18T22:03:26.573144903Z" }, "completed_at": { "title": "ActionTaken.CompletedAt", "type": "string", "format": "date-time", "x-anyOf": [ { "type": "string", "format": "date-time" }, { "type": "string" } ], "x-nullable": true, "description": "The time the action was completed", "example": "2026-08-18T22:03:26.573166824Z" }, "status": { "title": "ActionTaken.Status", "type": "string", "example": "completed", "description": "completed, failed, unknown" }, "observable": { "title": "ActionTaken.Observable", "type": "object", "properties": { "type": { "title": "ObservableType", "type": "string", "enum": [ "none", "file_path", "mac_address", "trend_micro_id", "cybereason_id", "process_args", "s1_agent_id", "device", "hostname", "certificate_common_name", "serial_number", "meraki_network_id", "url", "jamf_management_id", "certificate_serial", "intune_id", "meraki_org_id", "cisco_cm_id", "registry_key", "process_path", "darktrace_id", "process_username", "cortex_agent_id", "orbital_node_id", "process_uid", "ngfw_name", "user", "certificate_issuer", "ipv6", "email", "cisco_uc_id", "cvm_id", "sha256", "crowdstrike_id", "google_cloud_id", "google_chromebook_id", "acudid", "sha1", "registry_name", "md5", "service_now_id", "ip", "domain", "email_subject", "imei", "ngfw_id", "amp_computer_guid", "ms_machine_id", "secure_access_id", "mutex", "processor_id", "swc_device_id", "registry_path", "odns_identity", "odns_identity_label", "cisco_mid", "process_name", "pki_serial", "meraki_node_sn", "email_messageid", "imsi", "user_agent", "process_hash", "file_name" ], "description": "The type of the observable", "example": "domain" }, "value": { "title": "Observable.Value", "type": "string", "example": "ilo.brenz.pl", "description": "The value of the observable." } }, "required": [ "type", "value" ], "x-nullable": true, "description": "the process hash or file that was acted on" }, "count": { "title": "ActionTaken.Count", "type": "integer", "format": "int64", "x-nullable": true, "description": "The number of times this action was taken", "example": 1 } }, "required": [ "id", "action", "description", "reason", "source", "source_url", "started_at", "completed_at", "status" ], "description": "An action reported by a data source or XDR Automation." }, "description": "The actions that were taken on a device, entity, or observable." } }, "required": [ "type", "value", "indicators", "internal", "incoming-edges", "outgoing-edges", "investigated", "is_asset", "observableType", "observables", "modules", "sightings", "sources", "title" ] }, "times": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "integer", "format": "int64" } }, "required": [ "time" ] }, "uniqueItems": true } }, "required": [ "data", "times" ] } }, "edges": { "type": "object", "additionalProperties": { "type": "object", "properties": { "id1": { "type": "string" }, "id2": { "type": "string" }, "times": { "type": "array", "items": { "type": "object", "properties": { "time": { "type": "integer", "format": "int64" } }, "required": [ "time" ] }, "uniqueItems": true }, "data": { "type": "object", "properties": { "observed_times": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "value": { "type": "string" }, "sightings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }, "relation_info": {} }, "required": [ "value", "sightings" ] } }, "required": [ "id1", "id2", "times", "data" ] } }, "errors": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "E_DATA_TOO_LARGE" ] }, "message": { "type": "string" } }, "required": [ "type", "message" ] } } }, "required": [ "nodes", "edges" ] }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "investigation-id", "description": "", "type": "string", "required": true }, { "in": "query", "name": "important_observables", "description": "Include only data that is related to an important observable", "type": "boolean", "required": false }, { "in": "query", "name": "important_sightings", "description": "Include only data from important events", "type": "boolean", "required": false }, { "in": "query", "name": "important_only", "description": "Include only data from important events", "type": "boolean", "required": false }, { "in": "query", "name": "include_process_parents", "description": "Include parent processes when rendering execution relationships", "type": "boolean", "required": false }, { "in": "body", "name": "body", "description": "", "required": false, "schema": { "type": "object", "properties": { "important_observables": { "description": "Include only data that is related to an important observable", "type": "boolean" }, "important_sightings": { "description": "Include only data from important events", "type": "boolean" }, "important_only": { "description": "Include only data from important events", "type": "boolean" }, "include_process_parents": { "description": "Include parent processes when rendering execution relationships", "type": "boolean" } }, "x-nullable": true } } ], "tags": [ "v3", "Investigation Routes using Entities" ], "summary": "Graph Endpoint from entities.", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } }, "/v3/investigation/{investigation-id}/entity/{entity-id}": { "get": { "responses": { "405": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Method Not Allowed" ] } }, "required": [ "message" ] }, "description": "" }, "default": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "unspecified status" ] } }, "required": [ "message" ] }, "description": "" }, "429": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Too many requests" ] } }, "required": [ "message" ] }, "description": "" }, "401": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Unauthorized" ] } }, "required": [ "message" ] }, "description": "" }, "500": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "exception", "default exception", "sql exception", "JSON too large", "schema", "external_request" ] }, "exception": { "type": "string", "example": "SqlException" }, "data": { "example": { "example": "Bad Request" }, "description": "Any specific error information passed by custom errors." }, "uri": { "type": "string", "example": "/global/v1/incident/?/incident-summary", "description": "The URI the error was seen at" } }, "required": [ "message" ] }, "description": "" }, "200": { "schema": { "title": "Entity.EntityDetail", "type": "object", "properties": { "entity": { "type": "object", "properties": { "id": { "title": "Entity.ID", "type": "uuid", "example": "f1b0631b-d370-4de1-ad48-1df4d7b9e7de", "description": "The ID for an entity." }, "type": { "title": "Entity.Type.Enum", "type": "string", "enum": [ "device", "user", "hash", "attachment", "email" ], "description": "The type of the entity", "example": "device" }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" }, "label": { "title": "Entity.Label", "type": "string", "example": "link.exe", "description": "The canonical label for an entity" }, "ips": { "title": "Entity.Device.IPs", "type": "array", "items": { "type": "string" }, "example": [ "192.168.1.64", "192.168.1.163" ], "description": "The ip addresses of a device" } }, "required": [ "id", "type", "disposition", "investigated", "label" ], "x-anyOf": [ { "type": "object", "properties": { "id": { "title": "Entity.ID", "type": "uuid", "example": "f1b0631b-d370-4de1-ad48-1df4d7b9e7de", "description": "The ID for an entity." }, "type": { "title": "Entity.Type.Enum", "type": "string", "enum": [ "device", "user", "hash", "attachment", "email" ], "description": "The type of the entity", "example": "device" }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" }, "label": { "title": "Entity.Label", "type": "string", "example": "link.exe", "description": "The canonical label for an entity" }, "ips": { "title": "Entity.Device.IPs", "type": "array", "items": { "type": "string" }, "example": [ "192.168.1.64", "192.168.1.163" ], "description": "The ip addresses of a device" } }, "required": [ "id", "type", "disposition", "investigated", "label" ] }, { "type": "object", "properties": { "id": { "title": "Entity.ID", "type": "uuid", "example": "f1b0631b-d370-4de1-ad48-1df4d7b9e7de", "description": "The ID for an entity." }, "type": { "title": "Entity.Type.Enum", "type": "string", "enum": [ "device", "user", "hash", "attachment", "email" ], "description": "The type of the entity", "example": "device" }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" }, "label": { "title": "Entity.Label", "type": "string", "example": "link.exe", "description": "The canonical label for an entity" }, "names": { "title": "Entity.Device.Names", "type": "array", "items": { "type": "string" }, "example": [ "link@hyrule.net", "link" ], "description": "The names assocated with a user" } }, "required": [ "id", "type", "disposition", "investigated", "label", "names" ] }, { "type": "object", "properties": { "id": { "title": "Entity.ID", "type": "uuid", "example": "f1b0631b-d370-4de1-ad48-1df4d7b9e7de", "description": "The ID for an entity." }, "type": { "title": "Entity.Type.Enum", "type": "string", "enum": [ "device", "user", "hash", "attachment", "email" ], "description": "The type of the entity", "example": "device" }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" }, "label": { "title": "Entity.Label", "type": "string", "example": "link.exe", "description": "The canonical label for an entity" }, "algorithm": { "title": "Entity.Hash.Algorithm.Enum", "enum": [ [ "sha256", "sha1", "md5" ] ], "description": "The algorithm used to generate this hash", "example": "md5", "type": "string" }, "value": { "title": "Entity.Hash.Value", "type": "string", "description": "The value of the hash", "example": "c804ecb887cbf798f910a71a15771577" } }, "required": [ "id", "type", "disposition", "investigated", "label", "algorithm", "value" ] }, { "type": "object", "properties": { "id": { "title": "Entity.ID", "type": "uuid", "example": "f1b0631b-d370-4de1-ad48-1df4d7b9e7de", "description": "The ID for an entity." }, "type": { "title": "Entity.Type.Enum", "type": "string", "enum": [ "device", "user", "hash", "attachment", "email" ], "description": "The type of the entity", "example": "device" }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" }, "label": { "title": "Entity.Label", "type": "string", "example": "link.exe", "description": "The canonical label for an entity" }, "name": { "title": "Entity.Attachment.Name", "type": "string", "description": "Name of a device", "example": "Link's PC" }, "hashes": { "title": "Entity.Attachment.Hashes", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "description": "The Entity IDs of the hashes associated with this attachment", "example": [ "636712a3-2705-4bdb-9639-de8761b57b2b", "20c93a73-cc3c-4012-b807-38a49ec1bfd7" ] } }, "required": [ "id", "type", "disposition", "investigated", "label", "name", "hashes" ] }, { "type": "object", "properties": { "id": { "title": "Entity.ID", "type": "uuid", "example": "f1b0631b-d370-4de1-ad48-1df4d7b9e7de", "description": "The ID for an entity." }, "type": { "title": "Entity.Type.Enum", "type": "string", "enum": [ "device", "user", "hash", "attachment", "email" ], "description": "The type of the entity", "example": "device" }, "disposition": { "title": "DispositionEnum", "type": "integer", "enum": [ 1, 2, 3, 4, 5 ], "example": 1, "description": "Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown." }, "investigated": { "title": "Investigated", "type": "boolean", "example": false, "description": "If this specific observable was part of an investigation" }, "label": { "title": "Entity.Label", "type": "string", "example": "link.exe", "description": "The canonical label for an entity" }, "from": { "title": "Entity.Email.From", "type": "string", "example": "86518fc4-9401-4ebf-be28-730d2cb91762", "description": "The Entity ID of the user who sent the email" }, "to": { "title": "Entity.Email.To", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "description": "The Entity IDs of the users who received the email", "example": [ "759201b1-bfa2-4e6c-9a66-858e470d86d4", "06f7cf3a-deb5-4dc6-b08e-b0174d665c10" ] }, "attachment": { "title": "Entity.Email.Attachment", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "description": "The Entity IDs of the email attachments", "example": [ "61d9d2b4-b0f4-46f6-a309-35651ddcd445", "c2977a99-e0d4-4dc0-abe0-1653bf01e543" ] } }, "required": [ "id", "type", "disposition", "investigated", "label", "from", "to", "attachment" ] } ] }, "activities": { "type": "array", "items": { "type": "object", "properties": { "id": { "title": "Entity.ID", "type": "uuid", "example": "f1b0631b-d370-4de1-ad48-1df4d7b9e7de", "description": "The ID for an entity." }, "sighting": { "title": "Activity.Base.Sighting", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "description": "The sightings associated with the activity", "example": [ "45ed81d9-8e32-46e2-b604-7cf19114dd91", "d757f328-827d-4fb0-8729-b63f77289d0a" ] }, "observed_times": { "title": "Activity.Base.ObservedTimes", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "description": "The observed_times associated with the activity", "example": [ "1727117998000" ] }, "edges": { "title": "Activity.Base.Edges", "type": "array", "items": { "title": "Activity.Base.Edges.Edge", "type": "object", "properties": { "source": { "title": "Activity.Base.Edges.Edge.Source", "type": "string", "example": "0617f00c-bcee-4e8b-b18d-3511809c754d", "description": "The Entity ID of the first entity of the relationship" }, "related": { "title": "Activity.Base.Edges.Edge.Related", "type": "string", "example": "d126f865-c0eb-4d9f-9818-260263b3a77f", "description": "The Entity ID of the second entity of the relationship" }, "relation": { "title": "Activity.Base.Edges.Edge.Relation", "type": "string", "example": "Connected To", "description": "The name of the relationship" } }, "required": [ "source", "related", "relation" ], "description": "A relationship representing a discrete part of an activity" }, "description": "The relationships associated with the activity" }, "email_message": { "title": "Activity.EmailSent.EmailMessage", "type": "string", "example": "57c4a6c1-bab0-4994-a652-a4622b4fdc79", "description": "The Entity ID of the sent message" }, "connection_info": { "title": "Activity.EmailSent.ConnectionInfo", "type": "object", "properties": { "from_device": { "title": "Activity.EmailSent.ConnectionInfo.FromDevice", "type": "string", "example": "d5fa73df-c9f9-4444-bcbe-7b7ea8d8dfd8", "description": "The device that relayed the message to the receiving device" }, "to_device": { "title": "Activity.EmailSent.ConnectionInfo.ToDevice", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "description": "The devices that received the message", "example": [ "ef8227ed-95aa-4338-b888-0869ecace0e9", "71dd40ec-a367-4aa9-92ac-e97ff2550428" ] } }, "required": [ "from_device", "to_device" ], "description": "The connection information for the sent email" } }, "required": [ "id", "sighting", "observed_times", "edges", "email_message", "connection_info" ], "x-anyOf": [ { "type": "object", "properties": { "id": { "title": "Entity.ID", "type": "uuid", "example": "f1b0631b-d370-4de1-ad48-1df4d7b9e7de", "description": "The ID for an entity." }, "sighting": { "title": "Activity.Base.Sighting", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "description": "The sightings associated with the activity", "example": [ "45ed81d9-8e32-46e2-b604-7cf19114dd91", "d757f328-827d-4fb0-8729-b63f77289d0a" ] }, "observed_times": { "title": "Activity.Base.ObservedTimes", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "description": "The observed_times associated with the activity", "example": [ "1727117998000" ] }, "edges": { "title": "Activity.Base.Edges", "type": "array", "items": { "title": "Activity.Base.Edges.Edge", "type": "object", "properties": { "source": { "title": "Activity.Base.Edges.Edge.Source", "type": "string", "example": "0617f00c-bcee-4e8b-b18d-3511809c754d", "description": "The Entity ID of the first entity of the relationship" }, "related": { "title": "Activity.Base.Edges.Edge.Related", "type": "string", "example": "d126f865-c0eb-4d9f-9818-260263b3a77f", "description": "The Entity ID of the second entity of the relationship" }, "relation": { "title": "Activity.Base.Edges.Edge.Relation", "type": "string", "example": "Connected To", "description": "The name of the relationship" } }, "required": [ "source", "related", "relation" ], "description": "A relationship representing a discrete part of an activity" }, "description": "The relationships associated with the activity" }, "email_message": { "title": "Activity.EmailSent.EmailMessage", "type": "string", "example": "57c4a6c1-bab0-4994-a652-a4622b4fdc79", "description": "The Entity ID of the sent message" }, "connection_info": { "title": "Activity.EmailSent.ConnectionInfo", "type": "object", "properties": { "from_device": { "title": "Activity.EmailSent.ConnectionInfo.FromDevice", "type": "string", "example": "d5fa73df-c9f9-4444-bcbe-7b7ea8d8dfd8", "description": "The device that relayed the message to the receiving device" }, "to_device": { "title": "Activity.EmailSent.ConnectionInfo.ToDevice", "type": "array", "items": { "type": "string", "example": "string", "description": "String with at most 1024 characters." }, "description": "The devices that received the message", "example": [ "ef8227ed-95aa-4338-b888-0869ecace0e9", "71dd40ec-a367-4aa9-92ac-e97ff2550428" ] } }, "required": [ "from_device", "to_device" ], "description": "The connection information for the sent email" } }, "required": [ "id", "sighting", "observed_times", "edges", "email_message", "connection_info" ] } ] } } }, "required": [ "entity", "activities" ], "description": "The details for an entity including it's activities" }, "description": "" }, "404": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Found" ] } }, "required": [ "message" ] }, "description": "" }, "400": { "schema": { "type": "object", "properties": { "message": {} }, "required": [ "message" ] }, "description": "" }, "403": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Forbidden" ] } }, "required": [ "message" ] }, "description": "" }, "406": { "schema": { "type": "object", "properties": { "message": { "type": "string", "enum": [ "Not Acceptable" ] } }, "required": [ "message" ] }, "description": "" } }, "produces": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "consumes": [ "application/json", "application/transit+msgpack", "application/transit+json", "application/edn" ], "parameters": [ { "in": "path", "name": "investigation-id", "description": "", "type": "string", "required": true }, { "in": "path", "name": "entity-id", "description": "", "type": "string", "required": true } ], "tags": [ "v3", "Investigation Routes using Entities" ], "summary": "Get the attributes of an entity", "security": [ { "JWT-Bearer": [] }, { "oauth2": [] } ] } } }, "definitions": null }