Skip to main content
POST
/
workspace
/
{ws_id}
/
case_management
/
table
/
observables
Create an Observable
curl --request POST \
  --url https://app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/observables \
  --header 'BLINK-API-KEY: <api-key>' \
  --header 'Content-Type: */*' \
  --data '
{
  "content": "1.1.1.1",
  "description": "Suspicious IP address observed in network traffic",
  "enrichment_data": "{\"VirusTotal-Score\":\"value\"}",
  "name": "Suspicious IP Address",
  "reputation": "Suspicious/Risky",
  "type": "IP Address"
}
'
{
  "content": "1.1.1.1",
  "description": "Suspicious IP address observed in network traffic",
  "enrichment_data": "{\"VirusTotal-Score\":\"value\"}",
  "name": "Suspicious IP Address",
  "reputation": "Suspicious/Risky",
  "type": "IP Address"
}

Authorizations

​
BLINK-API-KEY
string
header
required

Use your API key to access BlinkOps API. To generate an API key, please log in to your BlinkOps account and navigate to the API Keys section in the user settings page. Add the generated key to your request headers as BLINK-API-KEY.

Path Parameters

​
ws_id
string
required

Workspace ID

Body

*/*

Observable Data

​
content
string
Example:

"1.1.1.1"

​
description
string
Example:

"Suspicious IP address observed in network traffic"

​
enrichment_data
string
Example:

"{\"VirusTotal-Score\":\"value\"}"

​
name
string
Example:

"Suspicious IP Address"

​
reputation
enum<string>
Available options:
Unknown,
Very Safe,
Safe,
Probably Safe,
Leans Safe,
May not be Safe,
Exercise Caution,
Suspicious/Risky,
Possibly Malicious,
Probably Malicious,
Malicious,
Other
Example:

"Suspicious/Risky"

​
type
enum<string>
Available options:
Unknown,
Hostname,
IP Address,
MAC Address,
User Name,
Email Address,
URL String,
File Name,
Hash,
Process Name,
Resource UID,
Port,
Subnet,
Command Line,
Country,
Process ID,
HTTP User-Agent,
CWE Object: uid,
CVE Object: uid,
User Credential ID,
Endpoint,
User,
Email,
Uniform Resource Locator,
File,
Process,
Geo Location,
Container,
Registry Key,
Registry Value,
Fingerprint,
Other
Example:

"IP Address"

Response

OK

​
content
string
Example:

"1.1.1.1"

​
description
string
Example:

"Suspicious IP address observed in network traffic"

​
enrichment_data
string
Example:

"{\"VirusTotal-Score\":\"value\"}"

​
name
string
Example:

"Suspicious IP Address"

​
reputation
enum<string>
Available options:
Unknown,
Very Safe,
Safe,
Probably Safe,
Leans Safe,
May not be Safe,
Exercise Caution,
Suspicious/Risky,
Possibly Malicious,
Probably Malicious,
Malicious,
Other
Example:

"Suspicious/Risky"

​
type
enum<string>
Available options:
Unknown,
Hostname,
IP Address,
MAC Address,
User Name,
Email Address,
URL String,
File Name,
Hash,
Process Name,
Resource UID,
Port,
Subnet,
Command Line,
Country,
Process ID,
HTTP User-Agent,
CWE Object: uid,
CVE Object: uid,
User Credential ID,
Endpoint,
User,
Email,
Uniform Resource Locator,
File,
Process,
Geo Location,
Container,
Registry Key,
Registry Value,
Fingerprint,
Other
Example:

"IP Address"