Cisco XDR APIs
- Cisco XDR APIs
- Guides
- Integrating with a Custom Application
- Modeling Threat Intelligence in CTIM
- Rate Limits
- API Reference
- Automation
- Overview
- API
- WorkflowInstances
- Handler to get all Workflow Instances
- Handler to get all Workflow Instances
- Handler to delete workflow instances in a batch
- Handler to get a summary of workflows instances
- Handler returning workflow instance information
- Handler to manage(cancel/pause/resume) a specific workflow instance
- Handler for delete workflow instance
- Handler returning information about action's instance
- # Handler to cancel a specific workflow instance
- Workflows
- Handler to get all workflows
- Handler to start workflow execution
- Handler to get all workflows
- Handler to get all workflows
- Handler to create a workflow definition
- # Handler to retrieve a list of workflows
- Handler to start workflow execution
- Handler to return required input parameters for the workflow
- Handler to get a summary of workflows
- Handler to return workflow information using workflow ID
- Handler to update the workflow
- Handler to delete workflow using ID
- Handler to add new action to workflow
- Handler to return Workflow's action information using action ID
- Handler to update an Action
- Handler to delete an action from workflow byId
- Handler to move actions in workflow
- Handler to duplicate action
- Handler to Lock the workflow
- Handler to return references for the workflow
- Handler to return rules for the workflow
- Handler to unlock a locked workflow. Param {workflow_id} accepts both an id and unique_name of the workflow
- Handler to validate workflow
- Handler to unintsall a workflow installed through exchange
- Handler to create a workflow definition from a given template
- Handler to update the workflow
- Calendars
- Categories
- ChangeOwner
- Comments
- Events
- EventsRateLimit
- Ratings
- References
- RemoteMeta
- Rules
- RuntimeUsers
- Schedules
- Schemas
- ShareObjectPermissions
- SXIROHIncident
- TableTypes
- Tables
- TargetGroups
- Targets
- Tasks
- Tenants
- VariableTypes
- Variables
- Webhooks
- Triggers
- Xchange
- Handler to refreshtoken if not available
- WorkflowInstances
- Model
- AccessMeta
- AccessMetaType
- ActionDefExport
- ActionDefinitionGetAllPropsResponse
- ActionDefinitionGetResponse
- ActionDefinitionPatchRequest
- ActionDefinitionPostRequest
- ActionDefinitionPutRequest
- ActionDefinitionPutResponse
- ActionFunc
- ActionInstanceGetAllResponse
- ActionInstanceGetResponse
- ActionOutputVariable
- ActionPatchRequest
- ActionTableInfo
- AddActionPostRequest
- AllReferences
- AssigneeResponse
- Calendar
- CalendarExport
- CalendarGetAllResponse
- CalendarGetResponse
- CalendarPostRequest
- CalendarPutRequest
- CategoryExport
- CategoryGetResponse
- CategoryPostRequest
- CategoryPutRequest
- CategoryType
- ChangeOwnerRequest
- ColumnData
- ColumnMapInfo
- CommentPostRequest
- CommentsPostRequestParams
- CourseOfAction
- CreateTableTypeGetResponse
- DefAccessMeta
- DefinitionExport
- Deprecated
- DueTaskDateInfo
- DynamicMap
- EntitlementSummary
- Event
- EventExport
- EventPostRequest
- EventPutRequest
- Expression
- ExternalLinks
- FormElement
- FormElementType
- GetAllCalendarPaginatedResponse
- GetAllCommentsResponse
- GetAllRuleResponse
- GetAllRulesPaginatedResponse
- GetAllTaskResponse
- GetAllTasksResponse
- GetAllVarTypesPostRequest
- GetAllVariableTypesResponse
- GetTaskResponse
- GitInfo
- GroupPermission
- IXChange
- InstallInfo
- LHObjType
- LHTime
- Lock
- MetaDataHdr
- MetadataRefreshToken
- MicroService
- ModuleInfo
- ObjectReference
- Obsolete
- OutputInfo
- PaginationLink
- PrevRulePriorityPatchRequest
- PublisherInfo
- RatingInfo
- RatingLoginUserRequest
- RatingPostRequest
- RatingPutRequest
- RatingResponse
- RelativeTime
- ReleaseNote
- RemoteMetaExport
- RemoteMetaGetAllResponse
- RemoteMetaGetResponse
- RemoteMetaPostRequest
- RemoteMetaPutRequest
- ResponseSummary
- Rule
- RuleExport
- RulePatchRequest
- RulePostRequest
- RulePriorityPatchRequest
- RulePutRequest
- RuleStatus
- RuleType
- RulesPostRequest
- RuntimeUserDefinitionGetAllResponse
- RuntimeUserDefinitionGetResponse
- RuntimeUserDefinitionPatchRequest
- RuntimeUserDefinitionPostRequest
- SXEventType
- SXIROHEventEmiter
- SXIROHIncidentData
- SXIROHIncidentPostRequest
- ScheduleDefinitionPostRequest
- ScheduleExport
- ScheduleGetAllResponse
- ScheduleGetResponse
- ScheduleProperties
- SchedulePutRequest
- Schema
- SchemaByTypeResponse
- SchemaNewPostRequest
- SchemaNewPostResponse
- SchemaPutRequest
- Serverless
- ShareObjectPermissions
- StartPointOption
- StartWorkflowResponse
- StartWorklfowConfigResponse
- State
- Status
- StatusDetails
- SubmitInfo
- TableExport
- TableGetResponse
- TablePostRequest
- TableRow
- TableRowAttributeDescription
- TableRowDescription
- TableTypeExport
- TableTypeSchemaResponse
- TakeActionRequest
- TargetDefinitionGetAllResponse
- TargetDefinitionGetResponse
- TargetDefinitionPostRequest
- TargetDefinitionPutRequest
- TargetGroupDefExport
- TargetGroupProperties
- TargetGroupRequest
- TargetIDsRequest
- TargetMetadata
- TaskDateInfo
- TaskPatchRequest
- TaskPriority
- TasksPostRequest
- TasksSummaryResponse
- TechVals
- TechValsModules
- Tenant
- TenantPutRequest
- Tier
- TierName
- TimeUnit
- Trigger
- TriggerExport
- TriggerPostRequest
- TriggerPutRequest
- TriggerStatus
- TriggerType
- UpdateTableRowPostRequest
- UserPermission
- UserTableRow
- Variable
- VariableContent
- VariableExport
- VariableGetAllResponse
- VariableGetResponse
- VariablePostRequest
- VariablePutRequest
- VariableStartPutRequest
- VariableTypeExport
- VariableTypeObjectKey
- VariableTypePostRequest
- VariableTypePutRequest
- WFExportObjects
- WFExportPostRequest
- WFInstancePaginationResponse
- WFRuleResponse
- WFVariableExport
- WebhookExport
- WebhookGetAllResponse
- WebhookGetResponse
- WebhookPostRequest
- WebhookPutRequest
- WfVariablePutRequest
- WorkflowDefExport
- WorkflowDefinitionGetAllResponse
- WorkflowDefinitionPutRequest
- WorkflowDefinitionPutRequestCommon
- WorkflowDefinitionPutRequestV2
- WorkflowDefinitionPutResponse
- WorkflowGetAllPaginationResponse
- WorkflowInstanceBatchDeletePostReq
- WorkflowInstanceGetAllResponse
- WorkflowInstanceGetResponse
- WorkflowLock
- WorkflowMetaData
- WorkflowMetadata
- WorkflowRuleTriggerExport
- WorkflowValidationGetResponse
- WorkflowsInstancePostRequest
- WorkflowsPostRequest
- XChange
- XChangeCategoryMetadata
- XChangeCreateRequest
- XChangeGlobalVariableMetadata
- XChangeIDOrder
- XChangeMetaData
- XChangeModuleTargetMetadata
- XChangePaginationPostRequest
- XChangeRUMetadata
- XChangeResponse
- XChangeRuleMetadata
- XChangeTargetGroupMetadata
- XChangeTargetMetadata
- XChangeUpdateRequest
- XChangeWFMetaData
- XChangeWFVariableMetadata
- XchangeGetAllPaginationResponse
- XchangeGetResponse
- comment
- createTableTypePutRequest
- eventsRateLimitGetResponse
- getAllCalendarsParam
- instancesSummaryResponse
- startWorklfowPostRequestPayload
- tableTypePostRequest
- tableTypePutRequest
- targetGroupGetAllResponse
- targetGroupGetResponse
- targetValidationResponse
- templateDefinitionPostRequest
- variableTypeGetResponse
- variableTypeResponse
- workflowDefinitionGetResponse
- workflowDefinitionPostRequest
- workflowObjRefResponse
- workflowSummaryResponse
- Platform APIs (IROH)
- Dashboard
- Enrich
- Overview
- API
- Model
- ActionType
- Activity
- Actor
- ActuatorType
- AdditionalProperties
- AlternateTerm
- Architecture
- Assertion
- AttackPattern
- COA
- CPELeafNode
- CPEMatch
- CPENode
- CVE
- CVEDataMeta
- CVSSv2
- CVSSv3
- Campaign
- ColumnDefinition
- CompositeIndicatorExpression
- Configurations
- Consequence
- Context
- DataTable
- DeliberateEnvelopedObserveBundle
- DeliberateEnvelopedObserveBundleData
- DeliberateEnvelopedObserveBundleDataDataActors
- DeliberateEnvelopedObserveBundleDataDataAttackPatterns
- DeliberateEnvelopedObserveBundleDataDataCampaigns
- DeliberateEnvelopedObserveBundleDataDataCoas
- DeliberateEnvelopedObserveBundleDataDataDataTables
- DeliberateEnvelopedObserveBundleDataDataFeedbacks
- DeliberateEnvelopedObserveBundleDataDataIdentityAssertions
- DeliberateEnvelopedObserveBundleDataDataIncidents
- DeliberateEnvelopedObserveBundleDataDataIndicators
- DeliberateEnvelopedObserveBundleDataDataJudgements
- DeliberateEnvelopedObserveBundleDataDataMalwares
- DeliberateEnvelopedObserveBundleDataDataNotes
- DeliberateEnvelopedObserveBundleDataDataRelationships
- DeliberateEnvelopedObserveBundleDataDataSightings
- DeliberateEnvelopedObserveBundleDataDataSightingsDocsRelationsRelationInfo
- DeliberateEnvelopedObserveBundleDataDataTools
- DeliberateEnvelopedObserveBundleDataDataVerdicts
- DeliberateEnvelopedObserveBundleDataDataVulnerabilities
- DeliberateEnvelopedObserveBundleDataDataWeaknesses
- DetectionMethod
- EnvelopedHealth
- EnvelopedHealthDataDataQuotas
- EnvelopedHealthDataDataQuotasKeyword847132
- EnvelopedHealthDataDataQuotasKeyword847132Values
- EnvelopedRefs
- EnvelopedSingleHealth
- EnvelopedSingleHealthDataDataQuotas
- EnvelopedSingleHealthDataDataQuotasKeyword847135
- EnvelopedSingleHealthDataDataQuotasKeyword847135Values
- ErrorMessage
- ExternalReference
- Feedback
- FileCreateType
- FileDeleteType
- FileModifyType
- FileMoveType
- HTTPType
- HealthStatus
- Identity
- IdentityAssertion
- IdentityCoordinates
- IdentitySpecification
- Incident
- IncidentScores
- IncidentTime
- Indicator
- Judgement
- JudgementSpecification
- KillChainPhase
- Language
- LibraryLoadType
- Malware
- MetaData
- Mitigation
- ModeOfIntroduction
- ModifierType
- ModuleHealthStatus
- ModuleObserveBundle
- NetflowType
- NormalizedError-401
- NormalizedError-500
- Note
- NoteRelatedEntity
- Observable
- ObserveEnvelopedObserveBundle
- ObserveEnvelopedObserveBundleData
- ObserveEnvelopedObserveBundleDataDataActors
- ObserveEnvelopedObserveBundleDataDataAttackPatterns
- ObserveEnvelopedObserveBundleDataDataCampaigns
- ObserveEnvelopedObserveBundleDataDataCoas
- ObserveEnvelopedObserveBundleDataDataDataTables
- ObserveEnvelopedObserveBundleDataDataFeedbacks
- ObserveEnvelopedObserveBundleDataDataIdentityAssertions
- ObserveEnvelopedObserveBundleDataDataIncidents
- ObserveEnvelopedObserveBundleDataDataIndicators
- ObserveEnvelopedObserveBundleDataDataJudgements
- ObserveEnvelopedObserveBundleDataDataMalwares
- ObserveEnvelopedObserveBundleDataDataNotes
- ObserveEnvelopedObserveBundleDataDataRelationships
- ObserveEnvelopedObserveBundleDataDataSightings
- ObserveEnvelopedObserveBundleDataDataSightingsDocsRelationsRelationInfo
- ObserveEnvelopedObserveBundleDataDataTools
- ObserveEnvelopedObserveBundleDataDataVerdicts
- ObserveEnvelopedObserveBundleDataDataVulnerabilities
- ObserveEnvelopedObserveBundleDataDataWeaknesses
- ObserveTargetsBody
- ObservedRelation
- ObservedTime
- OpenC2COA
- OpenIOCSpecification
- OperatingSystem
- Paradigm
- ProcessCreateType
- Ref
- RegistryCreateType
- RegistryDeleteType
- RegistryRenameType
- RegistrySetType
- RelatedCOA
- RelatedIdentity
- RelatedJudgement
- Relationship
- SIOCSpecification
- SensorCoordinates
- Sighting
- SightingDataTable
- SnortSpecification
- TargetType
- Technology
- ThreatBrainSpecification
- Tool
- Traffic
- ValidTime
- Verdict
- Vulnerability
- VulnerabilityImpact
- Weakness
- Incident Management
- Overview
- API
- Private Intel
- Search incidents in Private Intel. Incidents enriched with `:enrichment_status` when available
- Get MITRE tactic related to incident
- Get all MITRE tactics related to incident
- Get incident in Private Intel. Enriched with `:enrichment_status` when available
- Patch an incident in Private Intel
- Post an incident status to Private Intel
- Post an incident to Private Intel
- Search incident summaries in Private Intel for related entity data
- Post a Note to Private Intel
- POST many new entities using a single HTTP call
- DELETE many entities at once
- Return requested tactics with all techniques
- Return requested tactic with all techniques
- Return the Mitre coverage matrix, products metadata and any errors
- Update an asset's properties by its external id, and then asynchronously rescore provided incidents
- For each asset, update its asset properties by its external id, and then asynchronously rescore provided incidents
- Private Intel
- Model
- Adversary
- BaseTTPCoverage
- BulkActions
- BulkDeleteResult
- BulkErrors
- BulkRefs
- BulkUpdateAssetPropertiesBody
- BundleImportBundle
- BundleImportBundleActors
- BundleImportBundleActorsExternalReferences
- BundleImportBundleActorsIdentity
- BundleImportBundleActorsIdentityRelatedIdentities
- BundleImportBundleAssetMappings
- BundleImportBundleAssetMappingsExternalReferences
- BundleImportBundleAssetMappingsObservable
- BundleImportBundleAssetProperties
- BundleImportBundleAssetPropertiesExternalReferences
- BundleImportBundleAssetPropertiesProperties
- BundleImportBundleAssets
- BundleImportBundleAssetsExternalReferences
- BundleImportBundleCampaigns
- BundleImportBundleCampaignsActivity
- BundleImportBundleCampaignsExternalReferences
- BundleImportBundleCoasExternalReferences
- BundleImportBundleCoasOpenC2Coa
- BundleImportBundleCoasOpenC2CoaAction
- BundleImportBundleCoasOpenC2CoaActuator
- BundleImportBundleCoasOpenC2CoaModifiersAdditionalProperties
- BundleImportBundleCoasOpenC2CoaTarget
- BundleImportBundleCoasRelatedCoAs
- BundleImportBundleDataTables
- BundleImportBundleDataTablesColumns
- BundleImportBundleDataTablesExternalReferences
- BundleImportBundleExternalReferences
- BundleImportBundleFeedbacks
- BundleImportBundleFeedbacksExternalReferences
- BundleImportBundleIdentityAssertions
- BundleImportBundleIdentityAssertionsAssertions
- BundleImportBundleIdentityAssertionsExternalReferences
- BundleImportBundleIdentityAssertionsIdentity
- BundleImportBundleIdentityAssertionsIdentityObservables
- BundleImportBundleIncidents
- BundleImportBundleIncidentsExternalReferences
- BundleImportBundleIncidentsIncidentTime
- BundleImportBundleIndicators
- BundleImportBundleIndicatorsCompositeIndicatorExpression
- BundleImportBundleIndicatorsExternalReferences
- BundleImportBundleIndicatorsKillChainPhases
- BundleImportBundleIndicatorsSpecification
- BundleImportBundleIndicatorsSpecificationRequiredJudgements
- BundleImportBundleJudgements
- BundleImportBundleJudgementsExternalReferences
- BundleImportBundleJudgementsObservable
- BundleImportBundleMalwares
- BundleImportBundleMalwaresExternalReferences
- BundleImportBundleMalwaresKillChainPhases
- BundleImportBundleNotes
- BundleImportBundleNotesExternalReferences
- BundleImportBundleNotesRelatedEntities
- BundleImportBundleSightings
- BundleImportBundleSightingsContextFileCreateEvents
- BundleImportBundleSightingsContextFileCreateEventsTime
- BundleImportBundleSightingsContextFileDeleteEvents
- BundleImportBundleSightingsContextFileDeleteEventsTime
- BundleImportBundleSightingsContextFileModifyEvents
- BundleImportBundleSightingsContextFileModifyEventsTime
- BundleImportBundleSightingsContextFileMoveEvents
- BundleImportBundleSightingsContextFileMoveEventsTime
- BundleImportBundleSightingsContextHttpEvents
- BundleImportBundleSightingsContextHttpEventsTime
- BundleImportBundleSightingsContextHttpEventsTraffic
- BundleImportBundleSightingsContextLibraryLoadEvents
- BundleImportBundleSightingsContextLibraryLoadEventsTime
- BundleImportBundleSightingsContextNetflowEvents
- BundleImportBundleSightingsContextNetflowEventsTime
- BundleImportBundleSightingsContextNetflowEventsTraffic
- BundleImportBundleSightingsContextProcessCreateEvents
- BundleImportBundleSightingsContextProcessCreateEventsTime
- BundleImportBundleSightingsContextRegistryCreateEvents
- BundleImportBundleSightingsContextRegistryCreateEventsTime
- BundleImportBundleSightingsContextRegistryDeleteEvents
- BundleImportBundleSightingsContextRegistryDeleteEventsTime
- BundleImportBundleSightingsContextRegistryRenameEvents
- BundleImportBundleSightingsContextRegistryRenameEventsTime
- BundleImportBundleSightingsContextRegistrySetEvents
- BundleImportBundleSightingsContextRegistrySetEventsTime
- BundleImportBundleSightingsData
- BundleImportBundleSightingsDataColumns
- BundleImportBundleSightingsExternalReferences
- BundleImportBundleSightingsObservables
- BundleImportBundleSightingsObservedTime
- BundleImportBundleSightingsRelations
- BundleImportBundleSightingsRelationsRelated
- BundleImportBundleSightingsRelationsRelationInfo
- BundleImportBundleSightingsRelationsSource
- BundleImportBundleSightingsSensorCoordinates
- BundleImportBundleSightingsSensorCoordinatesObservables
- BundleImportBundleSightingsTargets
- BundleImportBundleSightingsTargetsObservables
- BundleImportBundleSightingsTargetsObservedTime
- BundleImportBundleTargetRecords
- BundleImportBundleTargetRecordsExternalReferences
- BundleImportBundleTargetRecordsTargets
- BundleImportBundleTargetRecordsTargetsObservables
- BundleImportBundleTargetRecordsTargetsObservedTime
- BundleImportBundleTools
- BundleImportBundleToolsExternalReferences
- BundleImportBundleToolsKillChainPhases
- BundleImportBundleVerdicts
- BundleImportBundleVerdictsObservable
- BundleImportBundleVulnerabilities
- BundleImportBundleVulnerabilitiesConfigurations
- BundleImportBundleVulnerabilitiesConfigurationsNodes
- BundleImportBundleVulnerabilitiesConfigurationsNodesChildren
- BundleImportBundleVulnerabilitiesConfigurationsNodesChildrenCpeMatch
- BundleImportBundleVulnerabilitiesConfigurationsNodesCpeMatch
- BundleImportBundleVulnerabilitiesCve
- BundleImportBundleVulnerabilitiesExternalReferences
- BundleImportBundleVulnerabilitiesImpactCvssV2
- BundleImportBundleVulnerabilitiesImpactCvssV3
- BundleImportBundleWeaknesses
- BundleImportBundleWeaknessesAlternateTerms
- BundleImportBundleWeaknessesArchitectures
- BundleImportBundleWeaknessesCommonConsequences
- BundleImportBundleWeaknessesDetectionMethods
- BundleImportBundleWeaknessesExternalReferences
- BundleImportBundleWeaknessesLanguages
- BundleImportBundleWeaknessesModesOfIntroduction
- BundleImportBundleWeaknessesNotes
- BundleImportBundleWeaknessesOperatingSystems
- BundleImportBundleWeaknessesParadigms
- BundleImportBundleWeaknessesPotentialMitigations
- BundleImportBundleWeaknessesTechnologies
- BundleImportResult
- CVEDataMeta
- Context
- CoveringProduct
- EntityImportResult
- ExternalReference
- GetUserError
- IdPMapping
- Incident
- IncidentScores
- IncidentSearchResults
- IncidentStatusUpdate
- IncidentSummarySearchResults
- IncidentSummarySearchResultsContextActors
- IncidentSummarySearchResultsContextActorsExternalReferences
- IncidentSummarySearchResultsContextActorsIdentity
- IncidentSummarySearchResultsContextActorsIdentityRelatedIdentities
- IncidentSummarySearchResultsContextActorsValidTime
- IncidentSummarySearchResultsContextAssetMappings
- IncidentSummarySearchResultsContextAssetMappingsExternalReferences
- IncidentSummarySearchResultsContextAssetMappingsObservable
- IncidentSummarySearchResultsContextAssetMappingsValidTime
- IncidentSummarySearchResultsContextAssetProperties
- IncidentSummarySearchResultsContextAssetPropertiesExternalReferences
- IncidentSummarySearchResultsContextAssetPropertiesProperties
- IncidentSummarySearchResultsContextAssetPropertiesValidTime
- IncidentSummarySearchResultsContextAssets
- IncidentSummarySearchResultsContextAssetsExternalReferences
- IncidentSummarySearchResultsContextAssetsValidTime
- IncidentSummarySearchResultsContextAttackPatterns
- IncidentSummarySearchResultsContextAttackPatternsExternalReferences
- IncidentSummarySearchResultsContextAttackPatternsKillChainPhases
- IncidentSummarySearchResultsContextCampaigns
- IncidentSummarySearchResultsContextCampaignsActivity
- IncidentSummarySearchResultsContextCampaignsExternalReferences
- IncidentSummarySearchResultsContextCampaignsValidTime
- IncidentSummarySearchResultsContextCoas
- IncidentSummarySearchResultsContextCoasExternalReferences
- IncidentSummarySearchResultsContextCoasOpenC2Coa
- IncidentSummarySearchResultsContextCoasOpenC2CoaAction
- IncidentSummarySearchResultsContextCoasOpenC2CoaActuator
- IncidentSummarySearchResultsContextCoasOpenC2CoaModifiers
- IncidentSummarySearchResultsContextCoasOpenC2CoaModifiersAdditionalProperties
- IncidentSummarySearchResultsContextCoasOpenC2CoaModifiersTime
- IncidentSummarySearchResultsContextCoasOpenC2CoaTarget
- IncidentSummarySearchResultsContextCoasRelatedCoAs
- IncidentSummarySearchResultsContextCoasValidTime
- IncidentSummarySearchResultsContextDataTables
- IncidentSummarySearchResultsContextDataTablesColumns
- IncidentSummarySearchResultsContextDataTablesExternalReferences
- IncidentSummarySearchResultsContextDataTablesValidTime
- IncidentSummarySearchResultsContextExternalReferences
- IncidentSummarySearchResultsContextFeedbacks
- IncidentSummarySearchResultsContextFeedbacksExternalReferences
- IncidentSummarySearchResultsContextIdentityAssertions
- IncidentSummarySearchResultsContextIdentityAssertionsAssertions
- IncidentSummarySearchResultsContextIdentityAssertionsExternalReferences
- IncidentSummarySearchResultsContextIdentityAssertionsIdentity
- IncidentSummarySearchResultsContextIdentityAssertionsIdentityObservables
- IncidentSummarySearchResultsContextIdentityAssertionsValidTime
- IncidentSummarySearchResultsContextIncidents
- IncidentSummarySearchResultsContextIncidentsExternalReferences
- IncidentSummarySearchResultsContextIncidentsIncidentTime
- IncidentSummarySearchResultsContextIndicators
- IncidentSummarySearchResultsContextIndicatorsCompositeIndicatorExpression
- IncidentSummarySearchResultsContextIndicatorsExternalReferences
- IncidentSummarySearchResultsContextIndicatorsKillChainPhases
- IncidentSummarySearchResultsContextIndicatorsSpecification
- IncidentSummarySearchResultsContextIndicatorsSpecificationRequiredJudgements
- IncidentSummarySearchResultsContextIndicatorsValidTime
- IncidentSummarySearchResultsContextJudgements
- IncidentSummarySearchResultsContextJudgementsExternalReferences
- IncidentSummarySearchResultsContextJudgementsObservable
- IncidentSummarySearchResultsContextJudgementsValidTime
- IncidentSummarySearchResultsContextMalwares
- IncidentSummarySearchResultsContextMalwaresExternalReferences
- IncidentSummarySearchResultsContextMalwaresKillChainPhases
- IncidentSummarySearchResultsContextNotes
- IncidentSummarySearchResultsContextNotesExternalReferences
- IncidentSummarySearchResultsContextNotesRelatedEntities
- IncidentSummarySearchResultsContextRelationships
- IncidentSummarySearchResultsContextRelationshipsExternalReferences
- IncidentSummarySearchResultsContextSightings
- IncidentSummarySearchResultsContextSightingsContext
- IncidentSummarySearchResultsContextSightingsContextFileCreateEvents
- IncidentSummarySearchResultsContextSightingsContextFileCreateEventsTime
- IncidentSummarySearchResultsContextSightingsContextFileDeleteEvents
- IncidentSummarySearchResultsContextSightingsContextFileDeleteEventsTime
- IncidentSummarySearchResultsContextSightingsContextFileModifyEvents
- IncidentSummarySearchResultsContextSightingsContextFileModifyEventsTime
- IncidentSummarySearchResultsContextSightingsContextFileMoveEvents
- IncidentSummarySearchResultsContextSightingsContextFileMoveEventsTime
- IncidentSummarySearchResultsContextSightingsContextHttpEvents
- IncidentSummarySearchResultsContextSightingsContextHttpEventsTime
- IncidentSummarySearchResultsContextSightingsContextHttpEventsTraffic
- IncidentSummarySearchResultsContextSightingsContextLibraryLoadEvents
- IncidentSummarySearchResultsContextSightingsContextLibraryLoadEventsTime
- IncidentSummarySearchResultsContextSightingsContextNetflowEvents
- IncidentSummarySearchResultsContextSightingsContextNetflowEventsTime
- IncidentSummarySearchResultsContextSightingsContextNetflowEventsTraffic
- IncidentSummarySearchResultsContextSightingsContextProcessCreateEvents
- IncidentSummarySearchResultsContextSightingsContextProcessCreateEventsTime
- IncidentSummarySearchResultsContextSightingsContextRegistryCreateEvents
- IncidentSummarySearchResultsContextSightingsContextRegistryCreateEventsTime
- IncidentSummarySearchResultsContextSightingsContextRegistryDeleteEvents
- IncidentSummarySearchResultsContextSightingsContextRegistryDeleteEventsTime
- IncidentSummarySearchResultsContextSightingsContextRegistryRenameEvents
- IncidentSummarySearchResultsContextSightingsContextRegistryRenameEventsTime
- IncidentSummarySearchResultsContextSightingsContextRegistrySetEvents
- IncidentSummarySearchResultsContextSightingsContextRegistrySetEventsTime
- IncidentSummarySearchResultsContextSightingsData
- IncidentSummarySearchResultsContextSightingsDataColumns
- IncidentSummarySearchResultsContextSightingsExternalReferences
- IncidentSummarySearchResultsContextSightingsObservables
- IncidentSummarySearchResultsContextSightingsObservedTime
- IncidentSummarySearchResultsContextSightingsRelations
- IncidentSummarySearchResultsContextSightingsRelationsRelated
- IncidentSummarySearchResultsContextSightingsRelationsRelationInfo
- IncidentSummarySearchResultsContextSightingsRelationsSource
- IncidentSummarySearchResultsContextSightingsSensorCoordinates
- IncidentSummarySearchResultsContextSightingsSensorCoordinatesObservables
- IncidentSummarySearchResultsContextSightingsTargets
- IncidentSummarySearchResultsContextSightingsTargetsObservables
- IncidentSummarySearchResultsContextSightingsTargetsObservedTime
- IncidentSummarySearchResultsContextTargetRecords
- IncidentSummarySearchResultsContextTargetRecordsExternalReferences
- IncidentSummarySearchResultsContextTargetRecordsTargets
- IncidentSummarySearchResultsContextTargetRecordsTargetsObservables
- IncidentSummarySearchResultsContextTargetRecordsTargetsObservedTime
- IncidentSummarySearchResultsContextTools
- IncidentSummarySearchResultsContextToolsExternalReferences
- IncidentSummarySearchResultsContextToolsKillChainPhases
- IncidentSummarySearchResultsContextValidTime
- IncidentSummarySearchResultsContextVerdicts
- IncidentSummarySearchResultsContextVerdictsObservable
- IncidentSummarySearchResultsContextVerdictsValidTime
- IncidentSummarySearchResultsContextVulnerabilities
- IncidentSummarySearchResultsContextVulnerabilitiesConfigurations
- IncidentSummarySearchResultsContextVulnerabilitiesConfigurationsNodes
- IncidentSummarySearchResultsContextVulnerabilitiesConfigurationsNodesChildren
- IncidentSummarySearchResultsContextVulnerabilitiesConfigurationsNodesChildrenCpeMatch
- IncidentSummarySearchResultsContextVulnerabilitiesConfigurationsNodesCpeMatch
- IncidentSummarySearchResultsContextVulnerabilitiesCve
- IncidentSummarySearchResultsContextVulnerabilitiesCveCveDataMeta
- IncidentSummarySearchResultsContextVulnerabilitiesExternalReferences
- IncidentSummarySearchResultsContextVulnerabilitiesImpact
- IncidentSummarySearchResultsContextVulnerabilitiesImpactCvssV2
- IncidentSummarySearchResultsContextVulnerabilitiesImpactCvssV3
- IncidentSummarySearchResultsContextWeaknesses
- IncidentSummarySearchResultsContextWeaknessesAlternateTerms
- IncidentSummarySearchResultsContextWeaknessesArchitectures
- IncidentSummarySearchResultsContextWeaknessesCommonConsequences
- IncidentSummarySearchResultsContextWeaknessesDetectionMethods
- IncidentSummarySearchResultsContextWeaknessesExternalReferences
- IncidentSummarySearchResultsContextWeaknessesLanguages
- IncidentSummarySearchResultsContextWeaknessesModesOfIntroduction
- IncidentSummarySearchResultsContextWeaknessesNotes
- IncidentSummarySearchResultsContextWeaknessesOperatingSystems
- IncidentSummarySearchResultsContextWeaknessesParadigms
- IncidentSummarySearchResultsContextWeaknessesPotentialMitigations
- IncidentSummarySearchResultsContextWeaknessesTechnologies
- IncidentSummarySearchResultsExternalReferences
- IncidentSummarySearchResultsIncidentTime
- IncidentTime
- IncidentWithEnrichmentStatus
- KillChainPhase
- MetaData
- MitreCoverage
- MitreCoverageAdversaries
- MitreError
- ModifierType
- MutableCtrProperties
- NewAttackPattern
- NewCOA
- NewIncident
- NewNote
- NewRelationship
- Note
- NoteRelatedEntity
- PartialBundle
- PatchIncident
- RiskScore
- RiskScores
- SCIMInfos
- TacticCoverage
- TacticView
- TechniqueCoverage
- TechniqueView
- UpdateAssetPropertiesBody
- User
- ValidTime
- VulnerabilityImpact
- Inspect
- Invite
- OAuth2
- Profile
- Overview
- API
- Profile
- Show your profile
- See `Org`
- Update `Org`
- List all other accounts
- Get access tokens for the requested user
- Get the available scopes for this JWT
- Verify if the available JWT scopes meet the requirements of your features
- Search for Org entitlements
- Get a single entitlement
- Return the entitlement summary for your Org
- Profile
- Model
- AccountStats
- ActivationMetas
- Entitlement
- EntitlementQuantity
- EntitlementSearchResult
- EntitlementSearchResultDataQuantity
- EntitlementSearchResultPaging
- EntitlementSearchStrs
- EntitlementSummary
- IdPMapping
- Org
- OrgAddress
- OrgIdPMapping
- OrgUserSettings
- PartialProfileOrgsStrs
- Permissions
- PermissionsResponse
- ProfileAccountsView
- ProfileAccountsViewOrgActivationMetasActivatedWith
- ProfileAccountsViewOrgActivationMetasActivatedWithDevices
- ProfileAccountsViewOrgActivationMetasActivatedWithModuleInstances
- ProfileAccountsViewOrgActivationMetasActivatedWithProvisioning
- ProfileInfos
- ProfileOrg
- ProfileOrgAddress
- ProfileUserTokensStrs
- SCIMInfos
- Summary
- TechnicalEntitlementSummary
- TokenResponse
- User
- Response
- Overview
- API
- Model
- Action
- ActionResult
- ColumnDefinition
- Context
- EnvelopedActionResult
- EnvelopedActions
- ErrorMessage
- ExternalReference
- FileCreateType
- FileDeleteType
- FileModifyType
- FileMoveType
- HTTPType
- IdentitySpecification
- LibraryLoadType
- NetflowType
- Observable
- ObservedRelation
- ObservedTime
- ProcessCreateType
- RegistryCreateType
- RegistryDeleteType
- RegistryRenameType
- RegistrySetType
- SensorCoordinates
- Sighting
- SightingDataTable
- SightingRelationsRelationInfo
- Traffic
- User
- Incidents and Investigations
- Overview
- API
- Casebook
- Investigation Creation
- Investigation Data
- Investigation Errors
- Investigation Entities
- Investigation Events
- Investigation Relation Graph
- Returns a list of indicators attached to this investigation
- Returns a list of observables attached to this investigation
- Returns metadata about the investigation
- Investigation Status
- Returns a Summary of the Investigation
- Returns a list of targets attached to this investigation
- Investigation Save/Update
- Incident
- Search incidents
- Get Count of Incidents by Search
- Get one incident
- Update one incident
- Delete one incident
- Patch one incident
- Link incident and entity (investigation | casebook | incident)
- Unlink incident and entity. (investigation | casebook | incident)
- Full Incident Summary. Equivalent Data to v1 summary endpoints
- Incident Assets
- Returns a list of observables linked to this incident
- Returns a list of indicators linked to this incident
- Returns a list of entities associated with this incident
- Returns a list of events linked to this incident
- Returns a graph representation of this incident
- Returns linked incidents
- Returns linked investigations
- Returns a list of errors reported by the attached investigations
- Returns the underlying incident's investigation status with surrounding threat context
- Update an incident status
- Returns baseline incident information
- Incident Report
- Incident Report Section
- Update Report Section
- Regenerate a Report Section
- Recommend actions for an incident
- Get a full summary of the incident, everything seen in XDR
- Import Incident and all its surrounding threat context from CTIA
- Global Intelligence
- Overview
- API
- Actor
- Adds a new Actor
- Get one Actor by ID
- Update an existing Actor
- Delete one Actor
- List Actor by external id
- Search for Actor entities using a ES query syntax and field filters
- Delete Actor entities matching given Lucene/ES query string or/and field filters
- Count Actor matching a Lucene/ES query string and field filters
- Histogram for some Actor field
- Topn for some Actor field
- Cardinality for some Actor field
- Attack Pattern
- Adds a new Attack-pattern
- Get one Attack-pattern by ID
- Update an existing Attack-pattern
- Delete one Attack-pattern
- List Attack-pattern by external id
- Search for Attack-pattern entities using a ES query syntax and field filters
- Delete Attack-pattern entities matching given Lucene/ES query string or/and field filters
- Count Attack-pattern matching a Lucene/ES query string and field filters
- Histogram for some Attack-pattern field
- Topn for some Attack-pattern field
- Cardinality for some Attack-pattern field
- AttackPattern corresponding to the MITRE external_references external_id
- Campaign
- Adds a new Campaign
- Get one Campaign by ID
- Update an existing Campaign
- Delete one Campaign
- List Campaign by external id
- Search for Campaign entities using a ES query syntax and field filters
- Delete Campaign entities matching given Lucene/ES query string or/and field filters
- Count Campaign matching a Lucene/ES query string and field filters
- Histogram for some Campaign field
- Topn for some Campaign field
- Cardinality for some Campaign field
- COA
- Adds a new Coa
- Get one Coa by ID
- Update an existing Coa
- Delete one Coa
- List Coa by external id
- Search for Coa entities using a ES query syntax and field filters
- Delete Coa entities matching given Lucene/ES query string or/and field filters
- Count Coa matching a Lucene/ES query string and field filters
- Histogram for some Coa field
- Topn for some Coa field
- Cardinality for some Coa field
- Event
- Feed
- Get a Feed View as newline separated entries
- Get a Feed View
- Adds a new Feed
- Gets a Feed by ID
- Updates a Feed
- Deletes a Feed
- List Feeds by external_id
- Search for a Feed using a Lucene/ES query string
- Delete Feed entities matching given Lucene/ES query string or/and field filters
- Count Feed entities matching given search filters
- Incident
- Update an Incident Status
- Adds a new Incident
- Get one Incident by ID
- Update an existing Incident
- Delete one Incident
- Partially update an existing Incident
- List Incident by external id
- Search for Incident entities using a ES query syntax and field filters
- Delete Incident entities matching given Lucene/ES query string or/and field filters
- Count Incident matching a Lucene/ES query string and field filters
- Average for some Incident field. Use X-Total-Hits header on response for count used for average. For aggregate-on field X.Y.Z, response body will be {:data {:X {:Y {:Z <average>}}}}. If X-Total-Hits is 0, then average will be nil
- Histogram for some Incident field
- Topn for some Incident field
- Cardinality for some Incident field
- Link an Incident to a Casebook or Investigation
- Returns Incident references associated with the specified observable based on Sighting relationships
- Indicator
- Adds a new Indicator
- Get one Indicator by ID
- Update an existing Indicator
- Delete one Indicator
- List Indicator by external id
- Search for Indicator entities using a ES query syntax and field filters
- Delete Indicator entities matching given Lucene/ES query string or/and field filters
- Count Indicator matching a Lucene/ES query string and field filters
- Histogram for some Indicator field
- Topn for some Indicator field
- Cardinality for some Indicator field
- Returns the Indicator references associated with the specified observable based on Judgement relationships
- Returns Indicator references associated with the specified observable based on Sighting relationships
- Judgement
- Adds a new Judgement
- Get one Judgement by ID
- Update an existing Judgement
- Delete one Judgement
- List Judgement by external id
- Search for Judgement entities using a ES query syntax and field filters
- Delete Judgement entities matching given Lucene/ES query string or/and field filters
- Count Judgement matching a Lucene/ES query string and field filters
- Histogram for some Judgement field
- Topn for some Judgement field
- Cardinality for some Judgement field
- Expires the supplied Judgement
- Returns the Judgements associated with the specified observable
- Malware
- Adds a new Malware
- Get one Malware by ID
- Update an existing Malware
- Delete one Malware
- List Malware by external id
- Search for Malware entities using a ES query syntax and field filters
- Delete Malware entities matching given Lucene/ES query string or/and field filters
- Count Malware matching a Lucene/ES query string and field filters
- Histogram for some Malware field
- Topn for some Malware field
- Cardinality for some Malware field
- Relationship
- Adds a new Relationship
- Get one Relationship by ID
- Update an existing Relationship
- Delete one Relationship
- List Relationship by external id
- Search for Relationship entities using a ES query syntax and field filters
- Delete Relationship entities matching given Lucene/ES query string or/and field filters
- Count Relationship matching a Lucene/ES query string and field filters
- Histogram for some Relationship field
- Topn for some Relationship field
- Cardinality for some Relationship field
- Sighting
- Adds a new Sighting
- Get one Sighting by ID
- Update an existing Sighting
- Delete one Sighting
- List Sighting by external id
- Search for Sighting entities using a ES query syntax and field filters
- Delete Sighting entities matching given Lucene/ES query string or/and field filters
- Count Sighting matching a Lucene/ES query string and field filters
- Histogram for some Sighting field
- Topn for some Sighting field
- Cardinality for some Sighting field
- Returns Sightings associated with the specified observable
- Tool
- Adds a new Tool
- Get one Tool by ID
- Update an existing Tool
- Delete one Tool
- List Tool by external id
- Search for Tool entities using a ES query syntax and field filters
- Delete Tool entities matching given Lucene/ES query string or/and field filters
- Count Tool matching a Lucene/ES query string and field filters
- Histogram for some Tool field
- Topn for some Tool field
- Cardinality for some Tool field
- Version
- Vulnerability
- List Vulnerabilities with configurations matching CPE 2.3 match strings
- Adds a new Vulnerability
- Get one Vulnerability by ID
- Update an existing Vulnerability
- Delete one Vulnerability
- List Vulnerability by external id
- Search for Vulnerability entities using a ES query syntax and field filters
- Delete Vulnerability entities matching given Lucene/ES query string or/and field filters
- Count Vulnerability matching a Lucene/ES query string and field filters
- Histogram for some Vulnerability field
- Topn for some Vulnerability field
- Cardinality for some Vulnerability field
- Weakness
- Adds a new Weakness
- Get one Weakness by ID
- Update an existing Weakness
- Delete one Weakness
- List Weakness by external id
- Search for Weakness entities using a ES query syntax and field filters
- Delete Weakness entities matching given Lucene/ES query string or/and field filters
- Count Weakness matching a Lucene/ES query string and field filters
- Histogram for some Weakness field
- Topn for some Weakness field
- Cardinality for some Weakness field
- Status
- Bulk
- Bundle
- Verdict
- Metrics
- Properties
- GraphQL
- Actor
- Model
- ActionType
- Activity
- Actor
- ActuatorType
- AdditionalProperties
- AlternateTerm
- Architecture
- AttackPattern
- Body100922
- Body100922IncidentsScores
- Body100922SightingsRelationsRelationInfo
- Body100925
- Body100925IncidentsScores
- Body100925SightingsRelationsRelationInfo
- Body100928
- Body100928IncidentsScores
- Body100930
- Body100930Actors
- Body100930ActorsError
- Body100930AttackPatterns
- Body100930AttackPatternsError
- Body100930Campaigns
- Body100930CampaignsError
- Body100930Coas
- Body100930CoasError
- Body100930Incidents
- Body100930IncidentsError
- Body100930Indicators
- Body100930IndicatorsError
- Body100930Judgements
- Body100930JudgementsError
- Body100930Malwares
- Body100930MalwaresError
- Body100930Relationships
- Body100930RelationshipsError
- Body100930Sightings
- Body100930SightingsError
- Body100930Tools
- Body100930ToolsError
- Body100930Vulnerabilities
- Body100930VulnerabilitiesError
- Body100930Weaknesses
- Body100930WeaknessesError
- Body100944
- Body100944SightingsRelationsRelationInfo
- BulkActions
- BulkErrors
- BundleExportIds
- BundleImportResult
- COA
- CPELeafNode
- CPEMatch
- CPENode
- CVE
- CVEDataMeta
- CVSSv2
- CVSSv3
- Campaign
- ColumnDefinition
- CompositeIndicatorExpression
- Configurations
- Consequence
- Context
- DetectionMethod
- EntityImportResult
- EventBucket
- ExternalReference
- Feed
- FeedView
- FileCreateType
- FileDeleteType
- FileModifyType
- FileMoveType
- HTTPType
- Identity
- IdentitySpecification
- Incident
- IncidentLinkRequest
- IncidentScores
- IncidentStatusUpdate
- IncidentTime
- Indicator
- Judgement
- JudgementSpecification
- KillChainPhase
- Language
- LibraryLoadType
- Malware
- MetaData
- MetricResult
- MetricResultData
- MetricResultFilters
- Mitigation
- ModeOfIntroduction
- ModifierType
- NetflowType
- NewActor
- NewAttackPattern
- NewBundleExport
- NewBundleExportActors
- NewBundleExportActorsExternalReferences
- NewBundleExportActorsIdentity
- NewBundleExportActorsIdentityRelatedIdentities
- NewBundleExportActorsValidTime
- NewBundleExportAssetMappings
- NewBundleExportAssetMappingsExternalReferences
- NewBundleExportAssetMappingsObservable
- NewBundleExportAssetMappingsValidTime
- NewBundleExportAssetProperties
- NewBundleExportAssetPropertiesExternalReferences
- NewBundleExportAssetPropertiesProperties
- NewBundleExportAssetPropertiesValidTime
- NewBundleExportAssets
- NewBundleExportAssetsExternalReferences
- NewBundleExportAssetsValidTime
- NewBundleExportAttackPatterns
- NewBundleExportAttackPatternsExternalReferences
- NewBundleExportAttackPatternsKillChainPhases
- NewBundleExportCampaigns
- NewBundleExportCampaignsActivity
- NewBundleExportCampaignsExternalReferences
- NewBundleExportCampaignsValidTime
- NewBundleExportCoas
- NewBundleExportCoasExternalReferences
- NewBundleExportCoasOpenC2Coa
- NewBundleExportCoasOpenC2CoaAction
- NewBundleExportCoasOpenC2CoaActuator
- NewBundleExportCoasOpenC2CoaModifiers
- NewBundleExportCoasOpenC2CoaModifiersAdditionalProperties
- NewBundleExportCoasOpenC2CoaModifiersTime
- NewBundleExportCoasOpenC2CoaTarget
- NewBundleExportCoasRelatedCoAs
- NewBundleExportCoasValidTime
- NewBundleExportDataTables
- NewBundleExportDataTablesColumns
- NewBundleExportDataTablesExternalReferences
- NewBundleExportDataTablesValidTime
- NewBundleExportExternalReferences
- NewBundleExportFeedbacks
- NewBundleExportFeedbacksExternalReferences
- NewBundleExportIdentityAssertions
- NewBundleExportIdentityAssertionsAssertions
- NewBundleExportIdentityAssertionsExternalReferences
- NewBundleExportIdentityAssertionsIdentity
- NewBundleExportIdentityAssertionsIdentityObservables
- NewBundleExportIdentityAssertionsValidTime
- NewBundleExportIncidents
- NewBundleExportIncidentsExternalReferences
- NewBundleExportIncidentsIncidentTime
- NewBundleExportIndicators
- NewBundleExportIndicatorsCompositeIndicatorExpression
- NewBundleExportIndicatorsExternalReferences
- NewBundleExportIndicatorsKillChainPhases
- NewBundleExportIndicatorsSpecification
- NewBundleExportIndicatorsSpecificationRequiredJudgements
- NewBundleExportIndicatorsValidTime
- NewBundleExportJudgements
- NewBundleExportJudgementsExternalReferences
- NewBundleExportJudgementsObservable
- NewBundleExportJudgementsValidTime
- NewBundleExportMalwares
- NewBundleExportMalwaresExternalReferences
- NewBundleExportMalwaresKillChainPhases
- NewBundleExportNotes
- NewBundleExportNotesExternalReferences
- NewBundleExportNotesRelatedEntities
- NewBundleExportRelationships
- NewBundleExportRelationshipsExternalReferences
- NewBundleExportSightings
- NewBundleExportSightingsContext
- NewBundleExportSightingsContextFileCreateEvents
- NewBundleExportSightingsContextFileCreateEventsTime
- NewBundleExportSightingsContextFileDeleteEvents
- NewBundleExportSightingsContextFileDeleteEventsTime
- NewBundleExportSightingsContextFileModifyEvents
- NewBundleExportSightingsContextFileModifyEventsTime
- NewBundleExportSightingsContextFileMoveEvents
- NewBundleExportSightingsContextFileMoveEventsTime
- NewBundleExportSightingsContextHttpEvents
- NewBundleExportSightingsContextHttpEventsTime
- NewBundleExportSightingsContextHttpEventsTraffic
- NewBundleExportSightingsContextLibraryLoadEvents
- NewBundleExportSightingsContextLibraryLoadEventsTime
- NewBundleExportSightingsContextNetflowEvents
- NewBundleExportSightingsContextNetflowEventsTime
- NewBundleExportSightingsContextNetflowEventsTraffic
- NewBundleExportSightingsContextProcessCreateEvents
- NewBundleExportSightingsContextProcessCreateEventsTime
- NewBundleExportSightingsContextRegistryCreateEvents
- NewBundleExportSightingsContextRegistryCreateEventsTime
- NewBundleExportSightingsContextRegistryDeleteEvents
- NewBundleExportSightingsContextRegistryDeleteEventsTime
- NewBundleExportSightingsContextRegistryRenameEvents
- NewBundleExportSightingsContextRegistryRenameEventsTime
- NewBundleExportSightingsContextRegistrySetEvents
- NewBundleExportSightingsContextRegistrySetEventsTime
- NewBundleExportSightingsData
- NewBundleExportSightingsDataColumns
- NewBundleExportSightingsExternalReferences
- NewBundleExportSightingsObservables
- NewBundleExportSightingsObservedTime
- NewBundleExportSightingsRelations
- NewBundleExportSightingsRelationsRelated
- NewBundleExportSightingsRelationsRelationInfo
- NewBundleExportSightingsRelationsSource
- NewBundleExportSightingsSensorCoordinates
- NewBundleExportSightingsSensorCoordinatesObservables
- NewBundleExportSightingsTargets
- NewBundleExportSightingsTargetsObservables
- NewBundleExportSightingsTargetsObservedTime
- NewBundleExportTargetRecords
- NewBundleExportTargetRecordsExternalReferences
- NewBundleExportTargetRecordsTargets
- NewBundleExportTargetRecordsTargetsObservables
- NewBundleExportTargetRecordsTargetsObservedTime
- NewBundleExportTools
- NewBundleExportToolsExternalReferences
- NewBundleExportToolsKillChainPhases
- NewBundleExportValidTime
- NewBundleExportVerdicts
- NewBundleExportVerdictsObservable
- NewBundleExportVerdictsValidTime
- NewBundleExportVulnerabilities
- NewBundleExportVulnerabilitiesConfigurations
- NewBundleExportVulnerabilitiesConfigurationsNodes
- NewBundleExportVulnerabilitiesConfigurationsNodesChildren
- NewBundleExportVulnerabilitiesConfigurationsNodesChildrenCpeMatch
- NewBundleExportVulnerabilitiesConfigurationsNodesCpeMatch
- NewBundleExportVulnerabilitiesCve
- NewBundleExportVulnerabilitiesCveCveDataMeta
- NewBundleExportVulnerabilitiesExternalReferences
- NewBundleExportVulnerabilitiesImpact
- NewBundleExportVulnerabilitiesImpactCvssV2
- NewBundleExportVulnerabilitiesImpactCvssV3
- NewBundleExportWeaknesses
- NewBundleExportWeaknessesAlternateTerms
- NewBundleExportWeaknessesArchitectures
- NewBundleExportWeaknessesCommonConsequences
- NewBundleExportWeaknessesDetectionMethods
- NewBundleExportWeaknessesExternalReferences
- NewBundleExportWeaknessesLanguages
- NewBundleExportWeaknessesModesOfIntroduction
- NewBundleExportWeaknessesNotes
- NewBundleExportWeaknessesOperatingSystems
- NewBundleExportWeaknessesParadigms
- NewBundleExportWeaknessesPotentialMitigations
- NewBundleExportWeaknessesTechnologies
- NewCOA
- NewCampaign
- NewFeed
- NewIncident
- NewIncidentScores
- NewIndicator
- NewJudgement
- NewMalware
- NewRelationship
- NewSighting
- NewSightingRelationsRelationInfo
- NewTool
- NewVulnerability
- NewWeakness
- Note
- Observable
- ObservedRelation
- ObservedTime
- OpenC2COA
- OpenIOCSpecification
- OperatingSystem
- Paradigm
- PartialActor
- PartialAttackPattern
- PartialCOA
- PartialCampaign
- PartialEvent
- PartialEventListEntity
- PartialEventListFieldsChange
- PartialFeed
- PartialIncident
- PartialIndicator
- PartialJudgement
- PartialMalware
- PartialNewIncident
- PartialNewIncidentExternalReferences
- PartialNewIncidentIncidentTime
- PartialNewIncidentScores
- PartialRelationship
- PartialSighting
- PartialSightingListRelationsRelationInfo
- PartialTool
- PartialVulnerability
- PartialWeakness
- ProcessCreateType
- RegistryCreateType
- RegistryDeleteType
- RegistryRenameType
- RegistrySetType
- RelatedCOA
- RelatedIdentity
- RelatedJudgement
- Relationship
- RelayGraphQLQuery
- RelayGraphQLResponse
- Response101043EventsEntity
- Response101043EventsFieldsChange
- Response101048Entity
- Response101048FieldsChange
- Response101070RelationsRelationInfo
- Response101100
- Response101100Actors
- Response101100ActorsError
- Response101100AttackPatterns
- Response101100AttackPatternsError
- Response101100Campaigns
- Response101100CampaignsError
- Response101100Coas
- Response101100CoasError
- Response101100Incidents
- Response101100IncidentsError
- Response101100Indicators
- Response101100IndicatorsError
- Response101100Judgements
- Response101100JudgementsError
- Response101100Malwares
- Response101100MalwaresError
- Response101100Relationships
- Response101100RelationshipsError
- Response101100Sightings
- Response101100SightingsError
- Response101100Tools
- Response101100ToolsError
- Response101100Vulnerabilities
- Response101100VulnerabilitiesError
- Response101100Weaknesses
- Response101100WeaknessesError
- Response101115
- Response101116
- Response101116SightingsRelationsRelationInfo
- Response101120
- Response101121
- SIOCSpecification
- SensorCoordinates
- Sighting
- SightingDataTable
- SightingRelationsRelationInfo
- SnortSpecification
- StatusInfo
- TargetType
- Technology
- TempIDs
- ThreatBrainSpecification
- Tool
- Traffic
- Update
- ValidTime
- Verdict
- VersionInfo
- Vulnerability
- VulnerabilityImpact
- Weakness
- Private Intelligence
- Overview
- API
- Actor
- Adds a new Actor
- Get one Actor by ID
- Update an existing Actor
- Delete one Actor
- List Actor by external id
- Search for Actor entities using a ES query syntax and field filters
- Delete Actor entities matching given Lucene/ES query string or/and field filters
- Count Actor matching a Lucene/ES query string and field filters
- Histogram for some Actor field
- Topn for some Actor field
- Cardinality for some Actor field
- Asset
- Adds a new Asset
- Get one Asset by ID
- Update an existing Asset
- Delete one Asset
- List Asset by external id
- Search for Asset entities using a ES query syntax and field filters
- Delete Asset entities matching given Lucene/ES query string or/and field filters
- Count Asset matching a Lucene/ES query string and field filters
- Histogram for some Asset field
- Topn for some Asset field
- Cardinality for some Asset field
- Asset Mapping
- Adds a new Asset-mapping
- Get one Asset-mapping by ID
- Update an existing Asset-mapping
- Delete one Asset-mapping
- List Asset-mapping by external id
- Search for Asset-mapping entities using a ES query syntax and field filters
- Delete Asset-mapping entities matching given Lucene/ES query string or/and field filters
- Count Asset-mapping matching a Lucene/ES query string and field filters
- Histogram for some Asset-mapping field
- Topn for some Asset-mapping field
- Cardinality for some Asset-mapping field
- Expires the supplied Asset-mapping
- Asset Properties
- Adds a new Asset-properties
- Get one Asset-properties by ID
- Update an existing Asset-properties
- Delete one Asset-properties
- List Asset-properties by external id
- Search for Asset-properties entities using a ES query syntax and field filters
- Delete Asset-properties entities matching given Lucene/ES query string or/and field filters
- Count Asset-properties matching a Lucene/ES query string and field filters
- Histogram for some Asset-properties field
- Topn for some Asset-properties field
- Cardinality for some Asset-properties field
- Expires the supplied Asset-properties
- Attack Pattern
- Adds a new Attack-pattern
- Get one Attack-pattern by ID
- Update an existing Attack-pattern
- Delete one Attack-pattern
- List Attack-pattern by external id
- Search for Attack-pattern entities using a ES query syntax and field filters
- Delete Attack-pattern entities matching given Lucene/ES query string or/and field filters
- Count Attack-pattern matching a Lucene/ES query string and field filters
- Histogram for some Attack-pattern field
- Topn for some Attack-pattern field
- Cardinality for some Attack-pattern field
- AttackPattern corresponding to the MITRE external_references external_id
- Campaign
- Adds a new Campaign
- Get one Campaign by ID
- Update an existing Campaign
- Delete one Campaign
- List Campaign by external id
- Search for Campaign entities using a ES query syntax and field filters
- Delete Campaign entities matching given Lucene/ES query string or/and field filters
- Count Campaign matching a Lucene/ES query string and field filters
- Histogram for some Campaign field
- Topn for some Campaign field
- Cardinality for some Campaign field
- Casebook
- Get one Casebook by ID
- Update an existing Casebook
- Delete one Casebook
- Partially Update a Casebook
- Edit Observables on a casebook
- Edit Texts on a casebook
- Edit a Bundle on a casebook
- Adds a new Casebook
- List Casebook by external id
- Search for Casebook entities using a ES query syntax and field filters
- Delete Casebook entities matching given Lucene/ES query string or/and field filters
- Count Casebook matching a Lucene/ES query string and field filters
- Histogram for some Casebook field
- Topn for some Casebook field
- Cardinality for some Casebook field
- COA
- Adds a new Coa
- Get one Coa by ID
- Update an existing Coa
- Delete one Coa
- List Coa by external id
- Search for Coa entities using a ES query syntax and field filters
- Delete Coa entities matching given Lucene/ES query string or/and field filters
- Count Coa matching a Lucene/ES query string and field filters
- Histogram for some Coa field
- Topn for some Coa field
- Cardinality for some Coa field
- Event
- Feed
- Get a Feed View as newline separated entries
- Get a Feed View
- Adds a new Feed
- Gets a Feed by ID
- Updates a Feed
- Deletes a Feed
- List Feeds by external_id
- Search for a Feed using a Lucene/ES query string
- Delete Feed entities matching given Lucene/ES query string or/and field filters
- Count Feed entities matching given search filters
- Incident
- Update an Incident Status
- Adds a new Incident
- Get one Incident by ID
- Update an existing Incident
- Delete one Incident
- Partially update an existing Incident
- List Incident by external id
- Search for Incident entities using a ES query syntax and field filters
- Delete Incident entities matching given Lucene/ES query string or/and field filters
- Count Incident matching a Lucene/ES query string and field filters
- Average for some Incident field. Use X-Total-Hits header on response for count used for average. For aggregate-on field X.Y.Z, response body will be {:data {:X {:Y {:Z <average>}}}}. If X-Total-Hits is 0, then average will be nil
- Histogram for some Incident field
- Topn for some Incident field
- Cardinality for some Incident field
- Link an Incident to a Casebook or Investigation
- Returns Incident references associated with the specified observable based on Sighting relationships
- Indicator
- Adds a new Indicator
- Get one Indicator by ID
- Update an existing Indicator
- Delete one Indicator
- List Indicator by external id
- Search for Indicator entities using a ES query syntax and field filters
- Delete Indicator entities matching given Lucene/ES query string or/and field filters
- Count Indicator matching a Lucene/ES query string and field filters
- Histogram for some Indicator field
- Topn for some Indicator field
- Cardinality for some Indicator field
- Returns the Indicator references associated with the specified observable based on Judgement relationships
- Returns Indicator references associated with the specified observable based on Sighting relationships
- Judgement
- Adds a new Judgement
- Get one Judgement by ID
- Update an existing Judgement
- Delete one Judgement
- List Judgement by external id
- Search for Judgement entities using a ES query syntax and field filters
- Delete Judgement entities matching given Lucene/ES query string or/and field filters
- Count Judgement matching a Lucene/ES query string and field filters
- Histogram for some Judgement field
- Topn for some Judgement field
- Cardinality for some Judgement field
- Expires the supplied Judgement
- Returns the Judgements associated with the specified observable
- Malware
- Adds a new Malware
- Get one Malware by ID
- Update an existing Malware
- Delete one Malware
- List Malware by external id
- Search for Malware entities using a ES query syntax and field filters
- Delete Malware entities matching given Lucene/ES query string or/and field filters
- Count Malware matching a Lucene/ES query string and field filters
- Histogram for some Malware field
- Topn for some Malware field
- Cardinality for some Malware field
- Relationship
- Adds a new Relationship
- Get one Relationship by ID
- Update an existing Relationship
- Delete one Relationship
- List Relationship by external id
- Search for Relationship entities using a ES query syntax and field filters
- Delete Relationship entities matching given Lucene/ES query string or/and field filters
- Count Relationship matching a Lucene/ES query string and field filters
- Histogram for some Relationship field
- Topn for some Relationship field
- Cardinality for some Relationship field
- Sighting
- Adds a new Sighting
- Get one Sighting by ID
- Update an existing Sighting
- Delete one Sighting
- List Sighting by external id
- Search for Sighting entities using a ES query syntax and field filters
- Delete Sighting entities matching given Lucene/ES query string or/and field filters
- Count Sighting matching a Lucene/ES query string and field filters
- Histogram for some Sighting field
- Topn for some Sighting field
- Cardinality for some Sighting field
- Returns Sightings associated with the specified observable
- Target Record
- Adds a new Target-record
- Get one Target-record by ID
- Update an existing Target-record
- Delete one Target-record
- List Target-record by external id
- Search for Target-record entities using a ES query syntax and field filters
- Delete Target-record entities matching given Lucene/ES query string or/and field filters
- Count Target-record matching a Lucene/ES query string and field filters
- Histogram for some Target-record field
- Topn for some Target-record field
- Cardinality for some Target-record field
- Tool
- Adds a new Tool
- Get one Tool by ID
- Update an existing Tool
- Delete one Tool
- List Tool by external id
- Search for Tool entities using a ES query syntax and field filters
- Delete Tool entities matching given Lucene/ES query string or/and field filters
- Count Tool matching a Lucene/ES query string and field filters
- Histogram for some Tool field
- Topn for some Tool field
- Cardinality for some Tool field
- Version
- Investigation
- Adds a new Investigation
- Get one Investigation by ID
- Update an existing Investigation
- Delete one Investigation
- List Investigation by external id
- Search for Investigation entities using a ES query syntax and field filters
- Delete Investigation entities matching given Lucene/ES query string or/and field filters
- Count Investigation matching a Lucene/ES query string and field filters
- Histogram for some Investigation field
- Topn for some Investigation field
- Cardinality for some Investigation field
- Vulnerability
- List Vulnerabilities with configurations matching CPE 2.3 match strings
- Adds a new Vulnerability
- Get one Vulnerability by ID
- Update an existing Vulnerability
- Delete one Vulnerability
- List Vulnerability by external id
- Search for Vulnerability entities using a ES query syntax and field filters
- Delete Vulnerability entities matching given Lucene/ES query string or/and field filters
- Count Vulnerability matching a Lucene/ES query string and field filters
- Histogram for some Vulnerability field
- Topn for some Vulnerability field
- Cardinality for some Vulnerability field
- Note
- Adds a new Note
- Get one Note by ID
- Update an existing Note
- Delete one Note
- Partially update an existing Note
- List Note by external id
- Search for Note entities using a ES query syntax and field filters
- Delete Note entities matching given Lucene/ES query string or/and field filters
- Count Note matching a Lucene/ES query string and field filters
- Histogram for some Note field
- Topn for some Note field
- Cardinality for some Note field
- Status
- Bulk
- Bundle
- Verdict
- Metrics
- Properties
- GraphQL
- Actor
- Model
- ActionType
- Activity
- Actor
- ActuatorType
- AdditionalProperties
- AlternateTerm
- Architecture
- Assertion
- Asset
- AssetMapping
- AssetProperties
- AssetProperty
- AttackPattern
- Body101436
- Body101436CasebooksBundleSightingsRelationsRelationInfo
- Body101436IncidentsScores
- Body101436InvestigationsExternalReferences
- Body101436InvestigationsTargets
- Body101436InvestigationsTargetsObservables
- Body101436InvestigationsTargetsObservedTime
- Body101436SightingsRelationsRelationInfo
- Body101447
- Body101447CasebooksBundleSightingsRelationsRelationInfo
- Body101447IncidentsScores
- Body101447InvestigationsExternalReferences
- Body101447InvestigationsTargets
- Body101447InvestigationsTargetsObservables
- Body101447InvestigationsTargetsObservedTime
- Body101447SightingsRelationsRelationInfo
- Body101458
- Body101458IncidentsScores
- Body101460
- Body101460Actors
- Body101460ActorsError
- Body101460AssetMappings
- Body101460AssetMappingsError
- Body101460AssetProperties
- Body101460AssetPropertiesError
- Body101460Assets
- Body101460AssetsError
- Body101460AttackPatterns
- Body101460AttackPatternsError
- Body101460Campaigns
- Body101460CampaignsError
- Body101460Casebooks
- Body101460CasebooksError
- Body101460Coas
- Body101460CoasError
- Body101460Incidents
- Body101460IncidentsError
- Body101460Indicators
- Body101460IndicatorsError
- Body101460Investigations
- Body101460InvestigationsError
- Body101460Judgements
- Body101460JudgementsError
- Body101460Malwares
- Body101460MalwaresError
- Body101460Notes
- Body101460NotesError
- Body101460Relationships
- Body101460RelationshipsError
- Body101460Sightings
- Body101460SightingsError
- Body101460TargetRecords
- Body101460TargetRecordsError
- Body101460Tools
- Body101460ToolsError
- Body101460Vulnerabilities
- Body101460VulnerabilitiesError
- Body101480
- Body101480SightingsRelationsRelationInfo
- BulkActions
- BulkErrors
- Bundle
- BundleExportIds
- BundleImportResult
- COA
- CPELeafNode
- CPEMatch
- CPENode
- CVE
- CVEDataMeta
- CVSSv2
- CVSSv3
- Campaign
- Casebook
- CasebookBundleSightingsRelationsRelationInfo
- CasebookBundleUpdate
- CasebookBundleUpdateBundle
- CasebookBundleUpdateBundleSightingsRelationsRelationInfo
- CasebookObservablesUpdate
- CasebookTextsUpdate
- ColumnDefinition
- CompositeIndicatorExpression
- Configurations
- Consequence
- Context
- DataTable
- DetectionMethod
- EntityImportResult
- EventBucket
- ExternalReference
- Feed
- FeedView
- Feedback
- FileCreateType
- FileDeleteType
- FileModifyType
- FileMoveType
- HTTPType
- Identity
- IdentityAssertion
- IdentityCoordinates
- IdentitySpecification
- Incident
- IncidentLinkRequest
- IncidentScores
- IncidentStatusUpdate
- IncidentTime
- Indicator
- Investigation
- InvestigationExternalReferences
- InvestigationTargets
- InvestigationTargetsObservables
- InvestigationTargetsObservedTime
- Judgement
- JudgementSpecification
- KillChainPhase
- Language
- LibraryLoadType
- Malware
- MetaData
- MetricResult
- MetricResultData
- MetricResultFilters
- Mitigation
- ModeOfIntroduction
- ModifierType
- NetflowType
- NewActor
- NewAsset
- NewAssetMapping
- NewAssetProperties
- NewAttackPattern
- NewBundleExport
- NewBundleExportActors
- NewBundleExportActorsExternalReferences
- NewBundleExportActorsIdentity
- NewBundleExportActorsIdentityRelatedIdentities
- NewBundleExportActorsValidTime
- NewBundleExportAssetMappings
- NewBundleExportAssetMappingsExternalReferences
- NewBundleExportAssetMappingsObservable
- NewBundleExportAssetMappingsValidTime
- NewBundleExportAssetProperties
- NewBundleExportAssetPropertiesExternalReferences
- NewBundleExportAssetPropertiesProperties
- NewBundleExportAssetPropertiesValidTime
- NewBundleExportAssets
- NewBundleExportAssetsExternalReferences
- NewBundleExportAssetsValidTime
- NewBundleExportAttackPatterns
- NewBundleExportAttackPatternsExternalReferences
- NewBundleExportAttackPatternsKillChainPhases
- NewBundleExportCampaigns
- NewBundleExportCampaignsActivity
- NewBundleExportCampaignsExternalReferences
- NewBundleExportCampaignsValidTime
- NewBundleExportCoas
- NewBundleExportCoasExternalReferences
- NewBundleExportCoasOpenC2Coa
- NewBundleExportCoasOpenC2CoaAction
- NewBundleExportCoasOpenC2CoaActuator
- NewBundleExportCoasOpenC2CoaModifiers
- NewBundleExportCoasOpenC2CoaModifiersAdditionalProperties
- NewBundleExportCoasOpenC2CoaModifiersTime
- NewBundleExportCoasOpenC2CoaTarget
- NewBundleExportCoasRelatedCoAs
- NewBundleExportCoasValidTime
- NewBundleExportDataTables
- NewBundleExportDataTablesColumns
- NewBundleExportDataTablesExternalReferences
- NewBundleExportDataTablesValidTime
- NewBundleExportExternalReferences
- NewBundleExportFeedbacks
- NewBundleExportFeedbacksExternalReferences
- NewBundleExportIdentityAssertions
- NewBundleExportIdentityAssertionsAssertions
- NewBundleExportIdentityAssertionsExternalReferences
- NewBundleExportIdentityAssertionsIdentity
- NewBundleExportIdentityAssertionsIdentityObservables
- NewBundleExportIdentityAssertionsValidTime
- NewBundleExportIncidents
- NewBundleExportIncidentsExternalReferences
- NewBundleExportIncidentsIncidentTime
- NewBundleExportIndicators
- NewBundleExportIndicatorsCompositeIndicatorExpression
- NewBundleExportIndicatorsExternalReferences
- NewBundleExportIndicatorsKillChainPhases
- NewBundleExportIndicatorsSpecification
- NewBundleExportIndicatorsSpecificationRequiredJudgements
- NewBundleExportIndicatorsValidTime
- NewBundleExportJudgements
- NewBundleExportJudgementsExternalReferences
- NewBundleExportJudgementsObservable
- NewBundleExportJudgementsValidTime
- NewBundleExportMalwares
- NewBundleExportMalwaresExternalReferences
- NewBundleExportMalwaresKillChainPhases
- NewBundleExportNotes
- NewBundleExportNotesExternalReferences
- NewBundleExportNotesRelatedEntities
- NewBundleExportRelationships
- NewBundleExportRelationshipsExternalReferences
- NewBundleExportSightings
- NewBundleExportSightingsContext
- NewBundleExportSightingsContextFileCreateEvents
- NewBundleExportSightingsContextFileCreateEventsTime
- NewBundleExportSightingsContextFileDeleteEvents
- NewBundleExportSightingsContextFileDeleteEventsTime
- NewBundleExportSightingsContextFileModifyEvents
- NewBundleExportSightingsContextFileModifyEventsTime
- NewBundleExportSightingsContextFileMoveEvents
- NewBundleExportSightingsContextFileMoveEventsTime
- NewBundleExportSightingsContextHttpEvents
- NewBundleExportSightingsContextHttpEventsTime
- NewBundleExportSightingsContextHttpEventsTraffic
- NewBundleExportSightingsContextLibraryLoadEvents
- NewBundleExportSightingsContextLibraryLoadEventsTime
- NewBundleExportSightingsContextNetflowEvents
- NewBundleExportSightingsContextNetflowEventsTime
- NewBundleExportSightingsContextNetflowEventsTraffic
- NewBundleExportSightingsContextProcessCreateEvents
- NewBundleExportSightingsContextProcessCreateEventsTime
- NewBundleExportSightingsContextRegistryCreateEvents
- NewBundleExportSightingsContextRegistryCreateEventsTime
- NewBundleExportSightingsContextRegistryDeleteEvents
- NewBundleExportSightingsContextRegistryDeleteEventsTime
- NewBundleExportSightingsContextRegistryRenameEvents
- NewBundleExportSightingsContextRegistryRenameEventsTime
- NewBundleExportSightingsContextRegistrySetEvents
- NewBundleExportSightingsContextRegistrySetEventsTime
- NewBundleExportSightingsData
- NewBundleExportSightingsDataColumns
- NewBundleExportSightingsExternalReferences
- NewBundleExportSightingsObservables
- NewBundleExportSightingsObservedTime
- NewBundleExportSightingsRelations
- NewBundleExportSightingsRelationsRelated
- NewBundleExportSightingsRelationsRelationInfo
- NewBundleExportSightingsRelationsSource
- NewBundleExportSightingsSensorCoordinates
- NewBundleExportSightingsSensorCoordinatesObservables
- NewBundleExportSightingsTargets
- NewBundleExportSightingsTargetsObservables
- NewBundleExportSightingsTargetsObservedTime
- NewBundleExportTargetRecords
- NewBundleExportTargetRecordsExternalReferences
- NewBundleExportTargetRecordsTargets
- NewBundleExportTargetRecordsTargetsObservables
- NewBundleExportTargetRecordsTargetsObservedTime
- NewBundleExportTools
- NewBundleExportToolsExternalReferences
- NewBundleExportToolsKillChainPhases
- NewBundleExportValidTime
- NewBundleExportVerdicts
- NewBundleExportVerdictsObservable
- NewBundleExportVerdictsValidTime
- NewBundleExportVulnerabilities
- NewBundleExportVulnerabilitiesConfigurations
- NewBundleExportVulnerabilitiesConfigurationsNodes
- NewBundleExportVulnerabilitiesConfigurationsNodesChildren
- NewBundleExportVulnerabilitiesConfigurationsNodesChildrenCpeMatch
- NewBundleExportVulnerabilitiesConfigurationsNodesCpeMatch
- NewBundleExportVulnerabilitiesCve
- NewBundleExportVulnerabilitiesCveCveDataMeta
- NewBundleExportVulnerabilitiesExternalReferences
- NewBundleExportVulnerabilitiesImpact
- NewBundleExportVulnerabilitiesImpactCvssV2
- NewBundleExportVulnerabilitiesImpactCvssV3
- NewBundleExportWeaknesses
- NewBundleExportWeaknessesAlternateTerms
- NewBundleExportWeaknessesArchitectures
- NewBundleExportWeaknessesCommonConsequences
- NewBundleExportWeaknessesDetectionMethods
- NewBundleExportWeaknessesExternalReferences
- NewBundleExportWeaknessesLanguages
- NewBundleExportWeaknessesModesOfIntroduction
- NewBundleExportWeaknessesNotes
- NewBundleExportWeaknessesOperatingSystems
- NewBundleExportWeaknessesParadigms
- NewBundleExportWeaknessesPotentialMitigations
- NewBundleExportWeaknessesTechnologies
- NewCOA
- NewCampaign
- NewCasebook
- NewCasebookBundleSightingsRelationsRelationInfo
- NewFeed
- NewIncident
- NewIncidentScores
- NewIndicator
- NewInvestigation
- NewInvestigationExternalReferences
- NewInvestigationTargets
- NewInvestigationTargetsObservables
- NewInvestigationTargetsObservedTime
- NewJudgement
- NewMalware
- NewNote
- NewRelationship
- NewSighting
- NewSightingRelationsRelationInfo
- NewTargetRecord
- NewTool
- NewVulnerability
- Note
- NoteRelatedEntity
- Observable
- ObservedRelation
- ObservedTime
- OpenC2COA
- OpenIOCSpecification
- OperatingSystem
- Paradigm
- PartialActor
- PartialAsset
- PartialAssetMapping
- PartialAssetProperties
- PartialAttackPattern
- PartialCOA
- PartialCampaign
- PartialCasebook
- PartialCasebookListBundleSightingsRelationsRelationInfo
- PartialEvent
- PartialEventListEntity
- PartialEventListFieldsChange
- PartialFeed
- PartialIncident
- PartialIndicator
- PartialInvestigation
- PartialInvestigationListExternalReferences
- PartialInvestigationListTargets
- PartialInvestigationListTargetsObservables
- PartialInvestigationListTargetsObservedTime
- PartialJudgement
- PartialMalware
- PartialNewCasebook
- PartialNewCasebookBundleSightingsRelationsRelationInfo
- PartialNewIncident
- PartialNewIncidentExternalReferences
- PartialNewIncidentIncidentTime
- PartialNewIncidentScores
- PartialNewNote
- PartialNewNoteExternalReferences
- PartialNewNoteRelatedEntities
- PartialNote
- PartialRelationship
- PartialSighting
- PartialSightingListRelationsRelationInfo
- PartialTargetRecord
- PartialTool
- PartialVulnerability
- ProcessCreateType
- RegistryCreateType
- RegistryDeleteType
- RegistryRenameType
- RegistrySetType
- RelatedCOA
- RelatedIdentity
- RelatedJudgement
- Relationship
- RelayGraphQLQuery
- RelayGraphQLResponse
- Response101500ExternalReferences
- Response101500Targets
- Response101500TargetsObservables
- Response101500TargetsObservedTime
- Response101631EventsEntity
- Response101631EventsFieldsChange
- Response101636Entity
- Response101636FieldsChange
- Response101667RelationsRelationInfo
- Response101685BundleSightingsRelationsRelationInfo
- Response101742
- Response101742Actors
- Response101742ActorsError
- Response101742AssetMappings
- Response101742AssetMappingsError
- Response101742AssetProperties
- Response101742AssetPropertiesError
- Response101742Assets
- Response101742AssetsError
- Response101742AttackPatterns
- Response101742AttackPatternsError
- Response101742Campaigns
- Response101742CampaignsError
- Response101742Casebooks
- Response101742CasebooksError
- Response101742Coas
- Response101742CoasError
- Response101742Incidents
- Response101742IncidentsError
- Response101742Indicators
- Response101742IndicatorsError
- Response101742Investigations
- Response101742InvestigationsError
- Response101742Judgements
- Response101742JudgementsError
- Response101742Malwares
- Response101742MalwaresError
- Response101742Notes
- Response101742NotesError
- Response101742Relationships
- Response101742RelationshipsError
- Response101742Sightings
- Response101742SightingsError
- Response101742TargetRecords
- Response101742TargetRecordsError
- Response101742Tools
- Response101742ToolsError
- Response101742Vulnerabilities
- Response101742VulnerabilitiesError
- Response101763
- Response101764
- Response101764CasebooksBundleSightingsRelationsRelationInfo
- Response101764InvestigationsExternalReferences
- Response101764InvestigationsTargets
- Response101764InvestigationsTargetsObservables
- Response101764InvestigationsTargetsObservedTime
- Response101764SightingsRelationsRelationInfo
- Response101776
- Response101777
- SIOCSpecification
- SensorCoordinates
- Sighting
- SightingDataTable
- SightingRelationsRelationInfo
- SnortSpecification
- StatusInfo
- Target
- TargetRecord
- TargetType
- Technology
- TempIDs
- Text
- ThreatBrainSpecification
- Tool
- Traffic
- Update
- ValidTime
- Verdict
- VersionInfo
- Vulnerability
- VulnerabilityImpact
- Weakness
- Playbook
- Overview
- API
- Incident
- Get the summary for an incident
- Post Note
- Create a link between the incident and the default playbook
- Get the action log for an incident id
- Get the status of an incident based on it's log entries
- Create a link between an incident and a playbook
- Get a list of ordered tasks and their workflow information for a incident
- Get a individual task summary for an Incident
- Execute a workflow for a task
- Set the status for a task in an incident
- Set the status for a phase in an incident
- Task
- Phase
- Playbook
- Get All Playbooks for an Org
- Create a new Playbook for an Org
- Get the default playbook for the org
- Get a Single Playbook for an Org
- Create a new version of a playbook
- Delete a specific playbook
- Perform a deep copy of a given Playbook
- Set the id of the playbook as the organization's default playbook for their organization
- Incident
- Automation
- Developer Resources
- Community and Support