Update an asset's properties by its external id, and then asynchronously rescore provided incidents - Cisco XDR APIs

{"type":"api","title":"Update an asset's properties by its external id, and then asynchronously rescore provided incidents","meta":{"id":"/apps/pubhub/media/cisco-xdr-api-docs/f4e065ff5977829c89df289df08411f83205f526/d7d3e58b-2412-342e-a80a-991bae0c0b01","info":{"title":"PrivateIntel Service","description":"A proxy to private-intel CTIA with various IROH hooks","contact":{"name":"Cisco Security Business Group -- Advanced Threat","email":"cisco-intel-api-support@cisco.com"},"license":{"name":"All Rights Reserved","url":"https://www.cisco.com"},"version":"1.0.107"},"security":[{"oAuth2":["integration:read","private-intel:read","profile:read","inspect:read","users:read","invite:read","enrich:read","oauth:read","response:read","global-intel:read","ao:read","playbook:read"]}],"tags":[{"name":"Private Intel","description":"Access private-intel"}],"x-parser-conf":{"serverConfig":"select","overview":{"markdownPath":"reference/incident-management/overview.md","uri":"incident-management-api-guide"},"disableAuthEditing":true,"exampleAsDefault":true,"oAuth2":{"clientId":"client-546e34fc-c6bf-4951-ac69-f6d7987a7814","clientSecret":"MYw4_E_tBdFwUwrX6WFYKVD5LQrG2k7XrJ5J046wWE0s1gAKCxJ8VA","proxyEnabled":false},"meta":{"useProxy":true}},"openapi":"3.0.1","servers":[{"url":"https://visibility.amp.cisco.com"}],"securitySchemes":{"oAuth2":{"type":"oauth2","flows":{"clientCredentials":{"tokenUrl":"https://visibility.amp.cisco.com/iroh/oauth2/token","scopes":{"telemetry":"Collect application data for analytics","integration:read":"Manage your modules","private-intel:read":"Access Private Intelligence","admin":"Provide admin privileges","cognitive":"Cognitive Integration","profile:read":"Get your profile information","inspect:read":"Extract Observables and data from text","asset":"Access and modify your assets","event":"Read IROH Events","feedback":"Submit Customer Feedback","sse":"SSE Integration. Manage your Devices.","registry":"Manage registry entries","users:read":"Manage users of your organization","investigation":"Perform threat analysis investigation","invite:read":"Invite users into your organization","casebook":"Access and modify your casebooks","playbook":"Access and modify your playbooks","orbital":"Orbital Integration.","enrich:read":"Query your configured modules for threat intelligence","oauth:read":"Manage OAuth2 Clients","vault":"Grants access to Module Vaults","response:read":"List and execute response actions using configured modules","notification":"Receive notifications from integrations","global-intel:read":"Access AMP Global Intelligence","webhook":"Manage your Webhooks","ao:read":"AO Integration."}}}}}},"spec":{"tags":["Private Intel"],"summary":"Update an asset's properties by its external id, and then asynchronously rescore provided incidents.","description":"This route should be called to update the cisco:ctr:assetValue or cisco:ctr:labels property of an asset.\n\nFor example, given an asset with external id transient:MY-DI-ASSET which is related to incidents:\n [ \"https://private.intel.amp.cisco.com/ctia/incident-11111\", \"https://private.intel.amp.cisco.com/ctia/incident-22222\", \"https://private.intel.amp.cisco.com/ctia/incident-33333\" ]\nthis request updates the asset's cisco:ctr:assetValue to 7 and cisco:ctr:labels to [\"label1\",\"label2\"], then schedules rescoring for the provided incidents.\n\nPATCH https://visibility.amp.cisco.com/iroh/private-intel/asset/external_id/transient%3AMY-DI-ASSET/update-properties\nBody:\n{\n \"rescore_incident_ids\" : [ \"https://private.intel.amp.cisco.com/ctia/incident-11111\", \"https://private.intel.amp.cisco.com/ctia/incident-22222\", \"https://private.intel.amp.cisco.com/ctia/incident-33333\" ],\n \"updated_properties\" : {\n \"cisco:ctr:assetValue\" : 7,\n \"cisco:ctr:labels\" : [ \"label1\", \"label2\" ]\n }\n}\n\nUp to 1000 incidents may be provided per request.","parameters":[{"name":"asset-external-id","in":"path","description":"The external identifier of the asset whose properties will be updated.","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"required":["rescore_incident_ids","updated_properties"],"type":"object","properties":{"updated_properties":{"required":["cisco:ctr:assetValue","cisco:ctr:labels"],"type":"object","properties":{"cisco:ctr:assetValue":{"type":"integer","description":"Integer value between 1 - 10","format":"int64"},"cisco:ctr:labels":{"type":"array","items":{"type":"string"}}},"additionalProperties":false,"description":"A map from asset property name to asset property value used to replace existing properties with those names for the specified asset.","$$ref":"#/components/schemas/MutableCtrProperties"},"rescore_incident_ids":{"type":"array","description":"List of incident ids to score asynchronously after updating asset properties.","items":{"type":"string"}}},"additionalProperties":false,"$$ref":"#/components/schemas/UpdateAssetPropertiesBody"}},"application/x-yaml":{"schema":{"required":["rescore_incident_ids","updated_properties"],"type":"object","properties":{"updated_properties":{"required":["cisco:ctr:assetValue","cisco:ctr:labels"],"type":"object","properties":{"cisco:ctr:assetValue":{"type":"integer","description":"Integer value between 1 - 10","format":"int64"},"cisco:ctr:labels":{"type":"array","items":{"type":"string"}}},"additionalProperties":false,"description":"A map from asset property name to asset property value used to replace existing properties with those names for the specified asset.","$$ref":"#/components/schemas/MutableCtrProperties"},"rescore_incident_ids":{"type":"array","description":"List of incident ids to score asynchronously after updating asset properties.","items":{"type":"string"}}},"additionalProperties":false,"$$ref":"#/components/schemas/UpdateAssetPropertiesBody"}},"application/edn":{"schema":{"required":["rescore_incident_ids","updated_properties"],"type":"object","properties":{"updated_properties":{"required":["cisco:ctr:assetValue","cisco:ctr:labels"],"type":"object","properties":{"cisco:ctr:assetValue":{"type":"integer","description":"Integer value between 1 - 10","format":"int64"},"cisco:ctr:labels":{"type":"array","items":{"type":"string"}}},"additionalProperties":false,"description":"A map from asset property name to asset property value used to replace existing properties with those names for the specified asset.","$$ref":"#/components/schemas/MutableCtrProperties"},"rescore_incident_ids":{"type":"array","description":"List of incident ids to score asynchronously after updating asset properties.","items":{"type":"string"}}},"additionalProperties":false,"$$ref":"#/components/schemas/UpdateAssetPropertiesBody"}},"application/transit+json":{"schema":{"required":["rescore_incident_ids","updated_properties"],"type":"object","properties":{"updated_properties":{"required":["cisco:ctr:assetValue","cisco:ctr:labels"],"type":"object","properties":{"cisco:ctr:assetValue":{"type":"integer","description":"Integer value between 1 - 10","format":"int64"},"cisco:ctr:labels":{"type":"array","items":{"type":"string"}}},"additionalProperties":false,"description":"A map from asset property name to asset property value used to replace existing properties with those names for the specified asset.","$$ref":"#/components/schemas/MutableCtrProperties"},"rescore_incident_ids":{"type":"array","description":"List of incident ids to score asynchronously after updating asset properties.","items":{"type":"string"}}},"additionalProperties":false,"$$ref":"#/components/schemas/UpdateAssetPropertiesBody"}},"application/transit+msgpack":{"schema":{"required":["rescore_incident_ids","updated_properties"],"type":"object","properties":{"updated_properties":{"required":["cisco:ctr:assetValue","cisco:ctr:labels"],"type":"object","properties":{"cisco:ctr:assetValue":{"type":"integer","description":"Integer value between 1 - 10","format":"int64"},"cisco:ctr:labels":{"type":"array","items":{"type":"string"}}},"additionalProperties":false,"description":"A map from asset property name to asset property value used to replace existing properties with those names for the specified asset.","$$ref":"#/components/schemas/MutableCtrProperties"},"rescore_incident_ids":{"type":"array","description":"List of incident ids to score asynchronously after updating asset properties.","items":{"type":"string"}}},"additionalProperties":false,"$$ref":"#/components/schemas/UpdateAssetPropertiesBody"}}},"required":true},"responses":{"200":{"description":"","content":{}}},"x-no-doc":false,"x-codegen-request-body-name":"UpdateAssetPropertiesBody","security":[{"oAuth2":["integration:read","private-intel:read","profile:read","inspect:read","users:read","invite:read","enrich:read","oauth:read","response:read","global-intel:read","ao:read","playbook:read"]}],"method":"patch","path":"/iroh/private-intel/asset/external_id/{asset-external-id}/update-properties"}}