{
  "opencollection": "1.0.0",
  "info": {
    "name": "Cyware Intel Exchange (CTIX) v3 Open Threat Data API",
    "version": "3.6.2"
  },
  "request": {
    "auth": {
      "type": "apikey",
      "key": "AccessID",
      "value": "{{AccessID}}",
      "placement": "query"
    }
  },
  "items": [
    {
      "info": {
        "name": "Threat Data",
        "type": "folder"
      },
      "items": [
        {
          "info": {
            "name": "Get Download Link",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{ctix_host}/ctixapi/ingestion/file/:file_id/",
            "params": [
              {
                "name": "page",
                "value": "",
                "type": "query",
                "description": "Pass the page number to retrieve records."
              },
              {
                "name": "page_size",
                "value": "",
                "type": "query",
                "description": "Pass the number of records to retrieve on each page."
              },
              {
                "name": "file_id",
                "value": "",
                "type": "path",
                "description": "Pass the file ID generated by the **Generate Export File API** endpoint."
              }
            ]
          },
          "docs": "Retrieves a URL to download the export file. The URL includes the file ID and a token."
        },
        {
          "info": {
            "name": "AI-Assisted Search",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{ctix_host}/ctixapi/ingestion/threat-data/ai-search/",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Converts a natural language prompt into an Intel Exchange search query.\n\n### Changelog\n\n<Accordion attributes='{\"style\":{\"width\":\"100%\"}}'>\n<AccordionItem title=\"Release v3.7.7.0\" iconUrl=\"\"><p>Added a new endpoint for AI-assisted search in Threat Data.</p></AccordionItem>\n</Accordion>"
        },
        {
          "info": {
            "name": "Bulk Add Analyst Score",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{ctix_host}/ctixapi/ingestion/threat-data/bulk-action/analyst_score/",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Add the analyst Confidence Score to multiple threat data objects."
        },
        {
          "info": {
            "name": "Bulk Add Relation",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{ctix_host}/ctixapi/ingestion/threat-data/bulk-action/add_relation/",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Add a relation to multiple threat data objects."
        },
        {
          "info": {
            "name": "Bulk Add/Remove Allowed Indicators",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{ctix_host}/ctixapi/ingestion/threat-data/bulk-action/:action_type/",
            "params": [
              {
                "name": "action_type",
                "value": "",
                "type": "path",
                "description": "Pass the action to be performed on the threat data objects."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Add or remove multiple threat data objects from the Allowed Indicators list in the platform."
        },
        {
          "info": {
            "name": "Bulk Add TLP",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{ctix_host}/ctixapi/ingestion/threat-data/bulk-action/analyst_tlp/",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Add an analyst TLP to multiple threat data objects."
        },
        {
          "info": {
            "name": "Bulk IOC Lookup (Advanced)",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{ctix_host}/ctixapi/ingestion/openapi/bulk-lookup/:object_type/",
            "params": [
              {
                "name": "enrichment_data",
                "value": "",
                "type": "query",
                "description": "Pass true to retrieve the latest five enrichment data objects."
              },
              {
                "name": "relation_data",
                "value": "",
                "type": "query",
                "description": "Pass true to retrieve the latest 100 relations details."
              },
              {
                "name": "enrichment_tools",
                "value": "",
                "type": "query",
                "description": "Pass the name of up to five enrichment tools separated by a comma. To retrieve a list of enrichment tools, use the **GET Enrichment Tools API** under **Administration** > **Enrichment Management** > **Enrichment Tools**."
              },
              {
                "name": "fields",
                "value": "",
                "type": "query",
                "description": "Pass a comma-separated list of field names to retrieve specific details of the objects. By default, all fields are retrieved."
              },
              {
                "name": "page",
                "value": "",
                "type": "query",
                "description": "Pass the page number to retrieve details from."
              },
              {
                "name": "page_size",
                "value": "",
                "type": "query",
                "description": "Pass the number of records to be retrieved per page."
              },
              {
                "name": "object_type",
                "value": "",
                "type": "path",
                "description": "Pass the object type to lookup. For the list of supported object types, see **Supported SDO Types** in **Threat Data** > **Miscellaneous**."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Performs a lookup for threat data objects in Intel Exchange and retrieves the details of the objects, such as basic details, enriched data, and relations."
        },
        {
          "info": {
            "name": "Bulk IOC Lookup and Create Intel",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{ctix_host}/ctixapi/ingestion/threat-data/bulk-lookup-and-create/",
            "params": [
              {
                "name": "enrichment",
                "value": "",
                "type": "query",
                "description": "Pass true to retrieve the last enriched details of the IOCs."
              },
              {
                "name": "create",
                "value": "",
                "type": "query",
                "description": "Pass true to create valid IOCs in the payload as threat data objects in the Threat Data module in Intel Exchange."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Perform a lookup for IOCs to retrieve the list of objects available in Intel Exchange. If some IOCs are not available in the platform, you can choose to create intel and ingest the missing IOCs. You can look up and ingest a maximum of 1000 IOCs in an API request.\n\nYou can perform a lookup for the following IOC types:\n\n*   IPv4\n    \n*   IPv6\n    \n*   Email Address\n    \n*   MD5\n    \n*   SHA1\n    \n*   SHA256\n    \n*   SHA512\n    \n*   SSDEEP\n    \n*   URL\n    \n*   Domain"
        },
        {
          "info": {
            "name": "Bulk Run Rule",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{ctix_host}/ctixapi/ingestion/threat-data/bulk-action/run_rule/",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Add a rule on multiple threat data objects. You can run rules that are configured for manual execution only."
        },
        {
          "info": {
            "name": "Generate Export File",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{ctix_host}/ctixapi/ingestion/export/",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Initiates export of threat data objects to a CSV file based on the CQL input. This API returns a file ID to retrieve the export file download link. You can export a maximum of 100,000 threat data objects in one API request.\n\n### **The Column Object**\n\nEach column object includes the key and value of a column. You can include the following columns in the export file:\n\n<Table style=\"width:100%;min-width:100%\" colSizes='[\"initial\",\"initial\"]' isHeaderAdded='true' tableHeader='[{\"id\":\"3a18cb23-fae9-"
        },
        {
          "info": {
            "name": "Get Threat Data List",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{ctix_host}/ctixapi/ingestion/threat-data/list/",
            "params": [
              {
                "name": "page",
                "value": "",
                "type": "query",
                "description": "Pass the page number to filter threat data objects by page number."
              },
              {
                "name": "page_size",
                "value": "",
                "type": "query",
                "description": "Pass the number of records per page to filter the threat data objects by page size."
              },
              {
                "name": "page_limit",
                "value": "",
                "type": "query",
                "description": "Pass the total number of threat data objects to be retrieved."
              },
              {
                "name": "enrichment",
                "value": "",
                "type": "query",
                "description": "Pass true to retrieve the details of the last enrichment details for the objects, if available."
              },
              {
                "name": "sort",
                "value": "",
                "type": "query",
                "description": "Pass the sorting order for the records."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Returns a list of threat data objects from Intel Exchange using a CQL query. You can retrieve a maximum of 500,000 threat data objects using this API.\n\nUse the following field mapping and operator references to write accurate CQL queries for this endpoint.\n\n<Accordion attributes='{\"style\":{\"width\":\"100%\"}}'>\n<AccordionItem title=\"CQL Field Mapping: UI vs API\" iconUrl=\"\"><p>The following table maps UI field labels and their associated values to the corresponding API field keys and values used in "
        },
        {
          "info": {
            "name": "Get Countries List",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{ctix_host}/ctixapi/ingestion/utilities/countries/",
            "params": [
              {
                "name": "full_list",
                "value": "",
                "type": "query",
                "description": "Pass true to disable pagination and retrieve the details of all countries."
              },
              {
                "name": "page",
                "value": "",
                "type": "query",
                "description": "Pass the page number to retrieve country details."
              },
              {
                "name": "page_size",
                "value": "",
                "type": "query",
                "description": "Pass the number of countries to retrieve on each page."
              },
              {
                "name": "query",
                "value": "",
                "type": "query",
                "description": "Pass a keyword to narrow the search."
              }
            ]
          },
          "docs": "Retrieves the details of a list of countries."
        },
        {
          "info": {
            "name": "Get IOC Types List",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{ctix_host}/ctixapi/ingestion/utilities/ioc-types/",
            "params": [
              {
                "name": "q",
                "value": "",
                "type": "query",
                "description": "Pass a keyword to narrow search results."
              },
              {
                "name": "page",
                "value": "",
                "type": "query",
                "description": "Pass the page number to retrieve records."
              },
              {
                "name": "page_size",
                "value": "",
                "type": "query",
                "description": "Pass the number of records to retrieve on each page."
              }
            ]
          },
          "docs": "Retrieves all the valid IOC types in Intel Exchange."
        },
        {
          "info": {
            "name": "Get Source Types List",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{ctix_host}/ctixapi/conversion/feed-sources/types/",
            "params": [
              {
                "name": "page",
                "value": "",
                "type": "query",
                "description": "Pass the page number to retrieve records."
              },
              {
                "name": "page_size",
                "value": "",
                "type": "query",
                "description": "Pass the number of records to retrieve on each page."
              }
            ]
          },
          "docs": "Returns the types of feed sources available in Intel Exchange."
        },
        {
          "info": {
            "name": "Get Sources List",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{ctix_host}/ctixapi/conversion/feed-sources/",
            "params": [
              {
                "name": "source_type",
                "value": "",
                "type": "query",
                "description": "Pass a comma-seperated list of the source type IDs to filter sources based on the type. You can retrieve the ID using the **List Source Types API**."
              },
              {
                "name": "nominal",
                "value": "",
                "type": "query",
                "description": "Pass true to apply the CQL query."
              },
              {
                "name": "page",
                "value": "",
                "type": "query",
                "description": "Pass the page number to retrieve sources."
              },
              {
                "name": "page_size",
                "value": "",
                "type": "query",
                "description": "Pass the number of sources to be retrieved on each page."
              }
            ]
          },
          "docs": "Returns a list of feed sources from Intel Exchange"
        },
        {
          "info": {
            "name": "Get Threat Data Object Preview",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{ctix_host}/ctixapi/ingestion/threat-data/:object_type/:object_id/quick_card/",
            "params": [
              {
                "name": "page",
                "value": "",
                "type": "query",
                "description": "Pass the page number to retrieve records."
              },
              {
                "name": "page_size",
                "value": "",
                "type": "query",
                "description": "Pass the number of records to retrieve on each page."
              },
              {
                "name": "object_type",
                "value": "",
                "type": "path",
                "description": "Pass the type of threat data objects. To get the list of supported object types, see **Supported SDO Types** in **Threat Data** > **Miscellaneous** > **List IOC Types**."
              },
              {
                "name": "object_id",
                "value": "",
                "type": "path",
                "description": "Pass the list of threat data object IDs to perform the bulk action. To retrieve a list of object IDs, use the **List Threat Data API** under the Threat Data section."
              }
            ]
          },
          "docs": "Retrieves specific details of a threat data object."
        },
        {
          "info": {
            "name": "Get Saved Searches List",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{ctix_host}/ctixapi/ingestion/saved-searches/",
            "params": [
              {
                "name": "page",
                "value": "",
                "type": "query",
                "description": "Pass the page number to retrieve the results from."
              },
              {
                "name": "page_size",
                "value": "",
                "type": "query",
                "description": "Pass the number of saved search records to be retrieved in each page."
              },
              {
                "name": "query",
                "value": "",
                "type": "query",
                "description": "Pass a keyword to narrow the search. Example, *malware*."
              }
            ]
          },
          "docs": "Lists the threat data queries that are saved by the user."
        },
        {
          "info": {
            "name": "Create Saved Search",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{ctix_host}/ctixapi/ingestion/saved-searches/",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Creates a saved search in Intel Exchange."
        },
        {
          "info": {
            "name": "Get Saved Search Details",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{ctix_host}/ctixapi/ingestion/saved-searches/:id/",
            "params": [
              {
                "name": "page",
                "value": "",
                "type": "query",
                "description": "Pass the page number to retrieve records."
              },
              {
                "name": "page_size",
                "value": "",
                "type": "query",
                "description": "Pass the number of records to retrieve on each page."
              },
              {
                "name": "id",
                "value": "",
                "type": "path",
                "description": "Pass the unique ID of a saved search. You can retrieve the ID using the **List Saved Searches API**. Example, *7f3a7db2-a042-4989-90bc-cd175b2fa9e1*."
              }
            ]
          },
          "docs": "Retrieves the details of a saved search."
        },
        {
          "info": {
            "name": "Update Saved Search",
            "type": "http"
          },
          "http": {
            "method": "PUT",
            "url": "https://{ctix_host}/ctixapi/ingestion/saved-searches/:id/",
            "params": [
              {
                "name": "id",
                "value": "",
                "type": "path",
                "description": "Pass the unique ID of a saved search to be update. You can retrieve the ID using the **List Saved Searches API**. Example, *1a7d5c8a-848a-4a67-af82-e68f3d823c65*."
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Updates the saved search data in Intel Exchange."
        },
        {
          "info": {
            "name": "Delete Saved Search",
            "type": "http"
          },
          "http": {
            "method": "DELETE",
            "url": "https://{ctix_host}/ctixapi/ingestion/saved-searches/:id/",
            "params": [
              {
                "name": "id",
                "value": "",
                "type": "path",
                "description": "Pass the unique ID of a saved search. You can retrieve the ID using the **List Saved Searches API**. Example, *dd545fe7-1f15-4938-b658-21b29be3698f*."
              }
            ]
          },
          "docs": "Deletes a saved search."
        },
        {
          "info": {
            "name": "Pin Saved Search",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{ctix_host}/ctixapi/ingestion/saved-searches/pin-saved-search/",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Pins a saved search in Intel Exchange."
        },
        {
          "info": {
            "name": "Update Pinned Saved Search",
            "type": "http"
          },
          "http": {
            "method": "PUT",
            "url": "https://{ctix_host}/ctixapi/ingestion/saved-searches/pin-saved-search/",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Updates the order of a pinned saved search in Intel Exchange."
        },
        {
          "info": {
            "name": "Remove Pined Saved Search",
            "type": "http"
          },
          "http": {
            "method": "DELETE",
            "url": "https://{ctix_host}/ctixapi/ingestion/saved-searches/pin-saved-search/",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Removes a saved search from the pinned search list."
        }
      ]
    }
  ],
  "bundled": true
}