Create an Observable

POST 
/workspace/:ws_id/case_management/table/observables

Adds a new Observable record.

Request

Path Parameters

ws_id stringrequired

Workspace ID

application/json

Body

required

Observable Data

content string
description string
enrichment_data string
name string
type string

Possible values: [Unknown, Hostname, IP Address, MAC Address, User Name, Email Address, URL String, File Name, Hash, Process Name, Resource UID, Port, Subnet, Command Line, Country, Process ID, HTTP User-Agent, CWE Object: uid, CVE Object: uid, User Credential ID, Endpoint, User, Email, Uniform Resource Locator, File, Process, Geo Location, Container, Registry Key, Registry Value, Fingerprint, Other]

verdict string

Possible values: [Unknown, Benign, Suspicious, Malicious]

Responses

200

OK

*/*

Schema

Schema

content string
description string
enrichment_data string
name string
type string

Possible values: [Unknown, Hostname, IP Address, MAC Address, User Name, Email Address, URL String, File Name, Hash, Process Name, Resource UID, Port, Subnet, Command Line, Country, Process ID, HTTP User-Agent, CWE Object: uid, CVE Object: uid, User Credential ID, Endpoint, User, Email, Uniform Resource Locator, File, Process, Geo Location, Container, Registry Key, Registry Value, Fingerprint, Other]

verdict string

Possible values: [Unknown, Benign, Suspicious, Malicious]

Example (from schema)

{
  "content": "1.1.1.1",
  "description": "Suspicious IP address observed in network traffic",
  "enrichment_data": "{\"VirusTotal-Score\":\"value\"}",
  "name": "Suspicious IP Address",
  "type": "IP Address",
  "verdict": "Suspicious"
}

400

Failed to create record

*/*

Schema

Schema

data
details string
identifier string
message string
status integer
user_error

Example (from schema)

{
  "data": {},
  "details": "string",
  "identifier": "string",
  "message": "string",
  "status": 404,
  "user_error": {}
}

Loading...