{"type":"model","meta":{"id":"/apps/pubhub/media/cisco-xdr-api-docs/f4e065ff5977829c89df289df08411f83205f526/d7d3e58b-2412-342e-a80a-991bae0c0b01","info":{"title":"PrivateIntel Service","description":"A proxy to private-intel CTIA with various IROH hooks","contact":{"name":"Cisco Security Business Group -- Advanced Threat","email":"cisco-intel-api-support@cisco.com"},"license":{"name":"All Rights Reserved","url":"https://www.cisco.com"},"version":"1.0.107"},"security":[{"oAuth2":["integration:read","private-intel:read","profile:read","inspect:read","users:read","invite:read","enrich:read","oauth:read","response:read","global-intel:read","ao:read","playbook:read"]}],"tags":[{"name":"Private Intel","description":"Access private-intel"}],"x-parser-conf":{"serverConfig":"select","overview":{"markdownPath":"reference/incident-management/overview.md","uri":"incident-management-api-guide"},"disableAuthEditing":true,"exampleAsDefault":true,"oAuth2":{"clientId":"client-546e34fc-c6bf-4951-ac69-f6d7987a7814","clientSecret":"MYw4_E_tBdFwUwrX6WFYKVD5LQrG2k7XrJ5J046wWE0s1gAKCxJ8VA","proxyEnabled":false},"meta":{"useProxy":true}},"openapi":"3.0.1","servers":[{"url":"https://visibility.amp.cisco.com"}],"securitySchemes":{"oAuth2":{"type":"oauth2","flows":{"clientCredentials":{"tokenUrl":"https://visibility.amp.cisco.com/iroh/oauth2/token","scopes":{"telemetry":"Collect application data for analytics","integration:read":"Manage your modules","private-intel:read":"Access Private Intelligence","admin":"Provide admin privileges","cognitive":"Cognitive Integration","profile:read":"Get your profile information","inspect:read":"Extract Observables and data from text","asset":"Access and modify your assets","event":"Read IROH Events","feedback":"Submit Customer Feedback","sse":"SSE Integration. Manage your Devices.","registry":"Manage registry entries","users:read":"Manage users of your organization","investigation":"Perform threat analysis investigation","invite:read":"Invite users into your organization","casebook":"Access and modify your casebooks","playbook":"Access and modify your playbooks","orbital":"Orbital Integration.","enrich:read":"Query your configured modules for threat intelligence","oauth:read":"Manage OAuth2 Clients","vault":"Grants access to Module Vaults","response:read":"List and execute response actions using configured modules","notification":"Receive notifications from integrations","global-intel:read":"Access AMP Global Intelligence","webhook":"Manage your Webhooks","ao:read":"AO Integration."}}}}}},"spec":{"type":"object","properties":{"type":{"type":"string","example":"verdict","enum":["verdict"]},"disposition":{"type":"integer","description":"Numeric verdict identifiers.","format":"int64","example":1,"enum":[1,4,3,2,5]},"observable":{"type":"object","properties":{"value":{"type":"string","description":"The value of the observable.","example":"1.2.3.4"},"type":{"type":"string","description":"The type of observable.","example":"ip","enum":["file_path","mac_address","trend_micro_id","cybereason_id","process_args","s1_agent_id","device","hostname","certificate_common_name","serial_number","meraki_network_id","url","certificate_serial","meraki_org_id","cisco_cm_id","registry_key","process_path","darktrace_id","process_username","cortex_agent_id","orbital_node_id","process_uid","ngfw_name","user","certificate_issuer","ipv6","email","cisco_uc_id","sha256","crowdstrike_id","sha1","registry_name","md5","ip","domain","email_subject","imei","ngfw_id","amp_computer_guid","ms_machine_id","mutex","processor_id","swc_device_id","registry_path","odns_identity","odns_identity_label","cisco_mid","process_name","pki_serial","meraki_node_sn","email_messageid","imsi","user_agent","process_hash","file_name"]}},"additionalProperties":false,"description":"A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.","example":{"value":"1.2.3.4","type":"ip"},"$$ref":"#/components/schemas/BundleImportBundleVerdictsObservable"},"judgement_id":{"type":"string","description":"A URI leading to a judgement.","example":"string"},"disposition_name":{"type":"string","description":"The disposition_name field is optional, but is intended to be shown to a user. Applications must therefore remember the mapping of numbers to human words, as in: {1 \"Clean\", 2 \"Malicious\", 3 \"Suspicious\", 4 \"Common\", 5 \"Unknown\"}","example":"Clean","enum":["Common","Unknown","Suspicious","Malicious","Clean"]},"valid_time":{"type":"object","properties":{"start_time":{"type":"string","description":"If not present, the valid time position of the indicator does not have an upper bound.","format":"date-time","example":"2016-01-01T01:01:01Z"},"end_time":{"type":"string","description":"If end_time is not present, then the valid time position of the object does not have an upper bound.","format":"date-time","example":"2016-01-01T01:01:01Z"}},"additionalProperties":false,"description":"Period of time when a cyber observation is valid.","example":{"start_time":"2016-01-01T01:01:01.000Z","end_time":"2016-01-01T01:01:01.000Z"},"$$ref":"#/components/schemas/ValidTime"}},"additionalProperties":false,"description":"A Verdict is chosen from all of the Judgements on that Observable which have not yet expired. The highest priority Judgement becomes the active verdict. If there is more than one Judgement with that priority, then Clean disposition has priority over all others, then Malicious disposition, and so on down to Unknown.\n\n The ID of a verdict is a a str of the form \"observable.type:observable.value\" for example, \"ip:1.1.1.1\"","example":{"type":"verdict","disposition":1,"observable":{"value":"1.2.3.4","type":"ip"},"judgement_id":"string","disposition_name":"Clean","valid_time":{"start_time":"2016-01-01T01:01:01.000Z","end_time":"2016-01-01T01:01:01.000Z"}},"$$ref":"#/components/schemas/BundleImportBundleVerdicts","title":"BundleImportBundleVerdicts"}}